@chengxianglibra/dsh-data-analysis 0.1.1 → 0.1.2

package/lib/types/client.d.ts

@@ -1,125 +1,7 @@
 import type { Context } from '@deepseek-ai/cordis';
-export declare const MARIVO_CREDENTIAL_STORAGE_PREFIX = "DSH_DATA_ANALYSIS_CREDENTIAL_";
-declare const EVIDENCE_SOURCES_META_KIND = "marivo-evidence-sources";
-declare const EVIDENCE_SOURCES_META_VERSION = 2;
-/** Browser-side copy of the Host mapping; contract tests keep both implementations identical. */
-export declare function marivoCredentialStorageRef(ref: string): string;
-export interface MarivoEvidenceSource {
-    status: 'available' | 'missing' | 'unsupported';
-    title: string;
-    locator: string;
-    excerpt: string | null;
-    truncated: boolean;
-    environmentFingerprint: string;
-    sessionId: string;
-    findingId: string;
-    findingType: string | null;
-    epistemicKind: string | null;
-    artifactRef: string;
-    canonicalItemKey: string | null;
-    committedAt: string | null;
-    sourceRefs: string[];
-    revalidation: {
-        status: string;
-        semanticStatus: string | null;
-        evidenceStatus: string | null;
-        dependencyStatus: string | null;
-    } | null;
-}
-export interface MarivoEvidenceSourcesMeta {
-    readonly kind: typeof EVIDENCE_SOURCES_META_KIND;
-    readonly version: typeof EVIDENCE_SOURCES_META_VERSION;
-    readonly dshSessionId: string;
-    readonly sources: readonly MarivoEvidenceSource[];
-}
-export interface MarivoEvidenceSourcesTurnDelivery {
-    readonly seq: number;
-    readonly sources: readonly MarivoEvidenceSource[];
-}
-export interface MarivoEvidenceSourcesTurnData {
-    readonly deliveries: readonly MarivoEvidenceSourcesTurnDelivery[];
-}
-interface MarivoEvidenceSourcesTurnState {
-    readonly turn: number;
-    readonly calls: ReadonlyMap<string, string>;
-    readonly deliveries: readonly MarivoEvidenceSourcesTurnDelivery[];
-}
-export interface MarivoEvidenceArtifactGroup {
-    readonly key: string;
-    readonly environmentFingerprint: string;
-    readonly sessionId: string;
-    readonly artifactRef: string;
-    readonly sources: readonly MarivoEvidenceSource[];
-}
-declare module '@deepseek-ai/dsh-client-runtime/client' {
-    interface ConversationTurnDataMap {
-        /** Explicitly requested Marivo Evidence sources collected from this exact Turn. */
-        'marivo-evidence-sources-delivery': MarivoEvidenceSourcesTurnData;
-    }
-}
-/** Parse the closed per-call source attachment persisted in Tool result metadata. */
-export declare function parseEvidenceSourcesMeta(value: unknown): MarivoEvidenceSourcesMeta | null;
-/** Decode the Code Mode-only source attachment from a durable sub-dispatch result. */
-export declare function parseEvidenceSourcesDurableContent(value: unknown): {
-    readonly turn: number;
-    readonly meta: MarivoEvidenceSourcesMeta;
-} | null;
-/** Recover one successful native or nested source attachment. */
-export declare function evidenceSourcesDeliveryFromEvent(event: any, calls?: ReadonlyMap<string, string>): MarivoEvidenceSourcesTurnDelivery | null;
-/** Aggregate explicit source attachments under one Harness-owned Turn key. */
-export declare const marivoEvidenceSourcesDeliveryDefinition: {
-    kind: string;
-    match(event: any): {
-        id: string;
-        role: string;
-    } | null;
-    start(_context: any, match: any): MarivoEvidenceSourcesTurnState;
-    update(context: any, match: any): MarivoEvidenceSourcesTurnState;
-    buildLocationData(context: any, scope: string): {
-        kind: string;
-        turn: any;
-        key: string;
-        value: {
-            deliveries: any;
-        };
-    } | null;
-};
-/** Successful sources completed before this exact closing Assistant message. */
-export declare function evidenceSourcesForClosing(owner: any): readonly MarivoEvidenceSource[];
-export declare function selectMarivoEvidenceSources(owner: any): readonly MarivoEvidenceSource[] | null;
-/** Group source presentation only; this does not infer Evidence equivalence or compatibility. */
-export declare function groupMarivoEvidenceSources(sources: readonly MarivoEvidenceSource[]): readonly MarivoEvidenceArtifactGroup[];
-export interface NeedsCredentialsResult {
-    status: 'needs-credentials';
-    name: string;
-    refs: string[];
-}
-export declare function parseNeedsCredentials(text: string): NeedsCredentialsResult | null;
-export declare function shouldAutoOpen(sessionId: string, callId: string, result: NeedsCredentialsResult | null): boolean;
-export declare function blankCredentialValues(refs: readonly string[]): Record<string, string>;
-export declare class CredentialDialogController {
-    readonly api: any;
-    constructor(api: any);
-    describe(refs: readonly string[]): Promise<Record<string, {
-        configured: boolean;
-    }>>;
-    inspect(refs: readonly string[]): Promise<{
-        configured: Record<string, boolean>;
-        missing: string[];
-        shouldOpen: boolean;
-    }>;
-    save(values: Readonly<Record<string, string>>): Promise<{
-        ok: boolean;
-        saved: string[];
-        errors: Record<string, string>;
-    }>;
-}
-export declare function MarivoDatasourceTestToolView(props: any): import("react").JSX.Element;
-export declare function MarivoDatasourceAccessToolView(props: any): import("react").JSX.Element;
-export declare function MarivoEvidenceSourcesPanel({ matched: sources, t, }: {
-    matched: readonly MarivoEvidenceSource[];
-    t: (key: string, values?: Record<string, string>) => string;
-}): import("react").JSX.Element;
+export { marivoPresentationDeliveryDefinition, parsePresentationDurableContent, presentationDeliveryFromEvent, presentationsForNode, } from './client/presentation/delivery.ts';
+export { PresentationDeliveryModel } from './client/presentation/delivery-model.ts';
+export { HostPresentationReader } from './client/presentation/host-entry.tsx';
+export { installPresentation, PresentationCards, PresentationOverlay, } from './client/presentation/install.tsx';
 export declare const inject: string[];
 export declare function apply(ctx: Context): void;
-export {};

package/lib/types/compatibility.d.ts

@@ -10,7 +10,7 @@ export interface DshDataAnalysisCompatibility {
         readonly packageSpec: string;
     };
     readonly contracts: {
-        readonly runtimeInstallation: 'dsh-data-analysis-runtime/v2';
+        readonly runtimeInstallation: 'dsh-data-analysis-runtime/v3';
         readonly subprocessPolicy: 'direct-argv-inherited-env-snapshot-overlay-v2';
     };
 }
@@ -25,5 +25,5 @@ export declare const DSH_PEER_DEPENDENCIES: Readonly<{
 }>;
 export declare const MARIVO_VERSION: string;
 export declare const MARIVO_PACKAGE_SPEC: string;
-export declare const RUNTIME_INSTALLATION_VERSION: "dsh-data-analysis-runtime/v2";
+export declare const RUNTIME_INSTALLATION_VERSION: "dsh-data-analysis-runtime/v3";
 export declare const SUBPROCESS_POLICY_VERSION: "direct-argv-inherited-env-snapshot-overlay-v2";

package/lib/types/datasource/authoring.d.ts

@@ -0,0 +1,25 @@
+import { z } from 'zod';
+export declare const datasourceAuthoringSchema: z.ZodObject<{
+    fingerprint: z.ZodString;
+    backends: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        fields: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            type: z.ZodEnum<{
+                string: "string";
+                number: "number";
+                boolean: "boolean";
+                json: "json";
+            }>;
+            required: z.ZodBoolean;
+            description: z.ZodString;
+            default: z.ZodOptional<z.ZodUnknown>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type DatasourceAuthoring = z.infer<typeof datasourceAuthoringSchema>;
+export interface DatasourceCreateInput {
+    backend: string;
+    fields: Record<string, unknown>;
+}
+export declare const DATASOURCE_AUTHORING_PROGRAM: string;

package/lib/types/datasource/bridge.d.ts

@@ -1,6 +1,7 @@
 import type { JsonValue } from '@deepseek-ai/dsh-session';
 import type { MarivoBridgeSource } from '../environment/source.ts';
 import type { MarivoCheckedRunner, MarivoEnvironmentBinding } from '../environment/types.ts';
+import { type DatasourceAuthoring, type DatasourceCreateInput } from './authoring.ts';
 interface JsonObject {
     [key: string]: JsonValue;
 }
@@ -13,7 +14,10 @@ export interface MarivoDatasourceFailure extends JsonObject {
 }
 export interface MarivoDatasourceRepair extends JsonObject {
     kind: string;
-    help_target: string;
+    help_target: {
+        surface: string;
+        canonical_id: string | null;
+    };
     action: string;
     snippet: string | null;
     candidates: string[];
@@ -21,7 +25,11 @@ export interface MarivoDatasourceRepair extends JsonObject {
 }
 export interface MarivoDatasourceDescription {
     name: string;
+    backend?: string;
+    properties?: Record<string, JsonValue>;
     refs: string[];
+    fields: Record<string, string>;
+    definition: string;
 }
 export interface MarivoDatasourceTestResult {
     name: string;
@@ -32,9 +40,14 @@ export interface MarivoDatasourceTestResult {
 }
 export interface MarivoDatasourceBridgePort {
     readonly binding: Readonly<MarivoEnvironmentBinding>;
+    authoring?(signal?: AbortSignal): Promise<DatasourceAuthoring>;
+    create?(input: DatasourceCreateInput, signal?: AbortSignal): Promise<{
+        name?: string;
+        error?: string;
+    }>;
     describe(name: string, signal?: AbortSignal): Promise<MarivoDatasourceDescription>;
     inventory(signal?: AbortSignal): Promise<MarivoDatasourceDescription[]>;
-    test(name: string, environmentOverlay: Readonly<NodeJS.ProcessEnv>, signal?: AbortSignal): Promise<MarivoDatasourceTestResult>;
+    test(description: Readonly<MarivoDatasourceDescription>, values: Readonly<Record<string, string>>, signal?: AbortSignal): Promise<MarivoDatasourceTestResult>;
 }
 export type MarivoDatasourceBridgeSource = MarivoBridgeSource<MarivoDatasourceBridgePort>;
 export type MarivoDatasourceInventoryBridge = Pick<MarivoDatasourceBridgePort, 'inventory'>;
@@ -44,9 +57,14 @@ export declare class MarivoDatasourceBridge {
     #private;
     readonly binding: Readonly<MarivoEnvironmentBinding>;
     constructor(runner: MarivoCheckedRunner);
+    authoring(signal?: AbortSignal): Promise<DatasourceAuthoring>;
+    create(input: DatasourceCreateInput, signal?: AbortSignal): Promise<{
+        name?: string;
+        error?: string;
+    }>;
     describe(name: string, signal?: AbortSignal): Promise<MarivoDatasourceDescription>;
     inventory(signal?: AbortSignal): Promise<MarivoDatasourceDescription[]>;
-    test(name: string, environmentOverlay: Readonly<NodeJS.ProcessEnv>, signal?: AbortSignal): Promise<MarivoDatasourceTestResult>;
+    test(description: Readonly<MarivoDatasourceDescription>, values: Readonly<Record<string, string>>, signal?: AbortSignal): Promise<MarivoDatasourceTestResult>;
 }
 export declare function resolveMarivoDatasourceBridge(source: MarivoDatasourceBridgeSource): Promise<MarivoDatasourceBridgePort>;
 export declare function resolveMarivoDatasourceInventoryBridge(source: MarivoDatasourceInventoryBridgeSource): Promise<MarivoDatasourceInventoryBridge>;

package/lib/types/datasource/index.d.ts

@@ -1,8 +1,6 @@
-export type { MarivoDatasourceAccessOptions, MarivoDatasourceAccessValue, } from './access.ts';
-export { createMarivoDatasourceAccessTool, MARIVO_DATASOURCE_ACCESS_TOOL_NAME, registerMarivoDatasourceAccessTool, } from './access.ts';
 export type { MarivoDatasourceBridgePort, MarivoDatasourceBridgeSource, MarivoDatasourceDescription, MarivoDatasourceFailure, MarivoDatasourceInventoryBridge, MarivoDatasourceInventoryBridgeSource, MarivoDatasourceRepair, MarivoDatasourceTestResult, } from './bridge.ts';
 export { MarivoDatasourceBridge, resolveMarivoDatasourceBridge, resolveMarivoDatasourceInventoryBridge, } from './bridge.ts';
-export type { MarivoShellLeaseReceipt } from './shell-env.ts';
-export { assertMarivoCredentialReferences, DEFAULT_MARIVO_CREDENTIAL_LEASE_MAX_USES, DEFAULT_MARIVO_CREDENTIAL_LEASE_TTL_MS, MARIVO_CREDENTIAL_LEASE_PREFIX, MARIVO_CREDENTIAL_STORAGE_PREFIX, MarivoShellCredentialLeases, marivoCredentialStorageRef, } from './shell-env.ts';
-export type { MarivoDatasourceTestOptions, MarivoDatasourceTestValue, } from './test.ts';
+export { registerMarivoPythonTool } from './python.ts';
+export { MarivoCredentialService } from './service.ts';
+export { assertMarivoCredentialReferences, MARIVO_CREDENTIAL_STORAGE_PREFIX, marivoCredentialStorageRef, } from './shell-env.ts';
 export { createMarivoDatasourceTestTool, MARIVO_DATASOURCE_TEST_TOOL_NAME, registerMarivoDatasourceTestTool, } from './test.ts';

package/lib/types/datasource/python.d.ts

@@ -0,0 +1,4 @@
+import type { Context } from '@deepseek-ai/cordis';
+import { type MarivoDatasourceBridgeSource } from './bridge.ts';
+import type { MarivoCredentialService } from './service.ts';
+export declare function registerMarivoPythonTool(ctx: Context, source: MarivoDatasourceBridgeSource, service: MarivoCredentialService): () => void;

package/lib/types/datasource/resolver-program.d.ts

@@ -0,0 +1,6 @@
+/** Shared Python adapter. All inputs below arrive on a Host-owned pipe. */
+export declare const RESOLVER_PROGRAM: string;
+/** The worker checks the exact binding and enters scope before any user code. */
+export declare const PYTHON_WORKER: string;
+/** Capture raw fd output before Harness collection/spill, including driver writes. */
+export declare const PYTHON_LAUNCHER: string;

package/lib/types/datasource/rpc.d.ts

@@ -0,0 +1,4 @@
+import type { HostConnectionHandle } from '@deepseek-ai/dsh-client-connection';
+import type { MarivoDatasourceBridgePort } from './bridge.ts';
+import { type MarivoCredentialService } from './service.ts';
+export declare function registerCredentialRpc(connection: HostConnectionHandle, service: MarivoCredentialService, workspace: (id: string) => Promise<MarivoDatasourceBridgePort>): () => Promise<void>;

package/lib/types/datasource/service.d.ts

@@ -0,0 +1,112 @@
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import { type CredentialProvider } from '@deepseek-ai/dsh-credentials';
+import type { JsonValue } from '@deepseek-ai/dsh-session';
+import type { ToolExecution } from '@deepseek-ai/dsh-tools';
+import type { DatasourceCreateInput } from './authoring.ts';
+import type { MarivoDatasourceBridgePort, MarivoDatasourceDescription, MarivoDatasourceTestResult } from './bridge.ts';
+export declare const CREDENTIAL_CHANNEL = "/dsh-data-analysis-credentials";
+export type CredentialStore = Pick<CredentialProvider, 'describe' | 'resolve' | 'set' | 'unset'>;
+export type CredentialAction = 'save' | 'update' | 'delete' | 'test' | 'submit' | 'diagnose';
+export interface CredentialContextView {
+    token: string;
+    workspaceId: string;
+    name: string;
+    backend: string;
+    properties: Record<string, JsonValue>;
+    refs: string[];
+    fields: Record<string, string>;
+    version: string;
+    credentials: Record<string, {
+        configured: boolean;
+        source?: string;
+        writable: boolean;
+    }>;
+    lastTest?: {
+        at: number;
+        result: MarivoDatasourceTestResult;
+        stale: boolean;
+    };
+}
+export interface CredentialRequestView {
+    id: string;
+    sessionId: string;
+    context: CredentialContextView;
+    status: 'awaiting-input' | 'executing' | 'awaiting-decision' | 'succeeded' | 'handed-off' | 'call-ended' | 'context-changed';
+    failure?: MarivoDatasourceTestResult;
+    endedAt?: number;
+}
+export interface CredentialOperationView {
+    id: string;
+    scope: string;
+    action: CredentialAction;
+    status: 'running' | 'succeeded' | 'failed' | 'cancelled';
+    phase: 'saving' | 'validating' | 'settled';
+    saved: string[];
+    errors: string[];
+    result?: MarivoDatasourceTestResult;
+    endedAt?: number;
+}
+export interface CredentialNeedsInput {
+    status: 'needs-credentials';
+    name: string;
+    refs: string[];
+}
+export interface PreparedCredentialExecution {
+    status: 'ready';
+    values: Record<string, string>;
+    grants: Record<string, MarivoDatasourceDescription>;
+    bridge: MarivoDatasourceBridgePort;
+    signal: AbortSignal;
+    /** Call synchronously immediately before starting the resolved Shell request. */
+    assertCurrent: () => void;
+    /** Forget values and stop operation-scoped credential tracking. */
+    release: () => void;
+}
+export declare class CredentialServiceError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+export declare function credentialError(error: unknown): string;
+/** Owns only plugin operations and execution-scoped waits. No value cache or datasource registry. */
+export declare class MarivoCredentialService {
+    #private;
+    readonly generation: `${string}-${string}-${string}-${string}-${string}`;
+    readonly interaction: 'web' | 'none';
+    readonly now: () => number;
+    constructor(store: CredentialStore, interaction?: 'web' | 'none', now?: () => number);
+    executionSignal(caller: AbortSignal, agent?: Agent): AbortSignal;
+    invalidateStorageRef(storageRef: string): void;
+    invalidate(refs: readonly string[]): void;
+    overview(workspaceId: string, resolve: () => Promise<MarivoDatasourceBridgePort>, caller: AbortSignal): Promise<CredentialContextView[]>;
+    createDatasource(generation: string, fingerprint: string, input: DatasourceCreateInput, resolve: () => Promise<MarivoDatasourceBridgePort>, caller: AbortSignal): Promise<{
+        name: string;
+    }>;
+    prepare(_kind: 'test', exec: ToolExecution, resolve: () => Promise<MarivoDatasourceBridgePort>, name: string): Promise<MarivoDatasourceTestResult | CredentialNeedsInput>;
+    prepareExecution(exec: ToolExecution, resolve: () => Promise<MarivoDatasourceBridgePort>, names: string[]): Promise<PreparedCredentialExecution | CredentialNeedsInput | MarivoDatasourceTestResult>;
+    watch(sessionId: string, cursor?: string): {
+        generation: string;
+        cursor: string;
+        requests: CredentialRequestView[];
+    };
+    waitWatch(sessionId: string, cursor: string | undefined, signal: AbortSignal): Promise<{
+        generation: string;
+        cursor: string;
+        requests: CredentialRequestView[];
+    }>;
+    operation(generation: string, id: string, scope: string): CredentialOperationView | undefined;
+    start(input: {
+        generation: string;
+        id: string;
+        scope: string;
+        action: CredentialAction;
+        version: string;
+        requestId?: string;
+        changes?: Record<string, string>;
+        reference?: string;
+    }): CredentialOperationView;
+    cancelOperation(generation: string, id: string, scope: string): void;
+    cancelRequest(id: string): void;
+    disposeAgent(agent: Agent): void;
+    track<T>(task: Promise<T>): Promise<T>;
+    close(): Promise<void>;
+}

package/lib/types/datasource/shell-env.d.ts

@@ -1,38 +1,9 @@
 import type { Context } from '@deepseek-ai/cordis';
-import type { Agent } from '@deepseek-ai/dsh-agent';
-import { type CredentialProvider } from '@deepseek-ai/dsh-credentials';
-import type { ToolExecution } from '@deepseek-ai/dsh-tools';
-import { type MarivoDatasourceBridgePort, type MarivoDatasourceBridgeSource } from './bridge.ts';
 export declare const MARIVO_CREDENTIAL_STORAGE_PREFIX = "DSH_DATA_ANALYSIS_CREDENTIAL_";
-export declare const MARIVO_CREDENTIAL_LEASE_PREFIX = "# dsh-marivo-credential-lease:";
-export declare const DEFAULT_MARIVO_CREDENTIAL_LEASE_TTL_MS: number;
-export declare const DEFAULT_MARIVO_CREDENTIAL_LEASE_MAX_USES = 64;
 type MarivoCredentialStorageRefName = `DSH_DATA_ANALYSIS_CREDENTIAL_${string}`;
-export interface MarivoShellLeaseReceipt {
-    [key: string]: string | number;
-    token: string;
-    expires_in_ms: number;
-    max_uses: number;
-    usage: 'bounded-foreground-shell-lease';
-    bash_prelude: string;
-    pwsh_prelude: string;
-}
 /** Publish the exact shared interpreter as a non-secret, per-execution DSH fact. */
 export declare function registerMarivoRuntimeShellEnvironment(ctx: Context, pythonExecutable: string): () => void;
 /** Map one user-authored datasource environment reference to plugin-owned DSH storage. */
 export declare function marivoCredentialStorageRef(ref: string): MarivoCredentialStorageRefName;
 export declare function assertMarivoCredentialReferences(refs: readonly string[]): void;
-/** Own bounded leases and expose credential values only to each admitted Shell execution. */
-export declare class MarivoShellCredentialLeases {
-    #private;
-    constructor(ctx: Context, credentials: Pick<CredentialProvider, 'resolve'>, options?: {
-        ttlMs?: number;
-        maxUses?: number;
-    });
-    revokeLease(agent: Agent, bridge: MarivoDatasourceBridgePort, datasourceName: string): void;
-    issueLease(agent: Agent, bridge: MarivoDatasourceBridgePort, datasourceName: string, refs: readonly string[]): MarivoShellLeaseReceipt;
-    prepareExecution(agent: Agent, bridgeSource: MarivoDatasourceBridgeSource, execution: ToolExecution): Promise<boolean>;
-    installAgent(agent: Agent, bridgeSource: MarivoDatasourceBridgeSource): () => void;
-    dispose(): void;
-}
 export {};

package/lib/types/datasource/test.d.ts

@@ -1,32 +1,9 @@
 import type { Context } from '@deepseek-ai/cordis';
-import type { CredentialProvider } from '@deepseek-ai/dsh-credentials';
-import type { JsonValue } from '@deepseek-ai/dsh-session';
 import { type ToolDefinition } from '@deepseek-ai/dsh-tools';
-import { type MarivoDatasourceBridgePort, type MarivoDatasourceBridgeSource, type MarivoDatasourceFailure, type MarivoDatasourceRepair } from './bridge.ts';
+import { type MarivoDatasourceBridgeSource } from './bridge.ts';
+import type { MarivoCredentialService } from './service.ts';
 export declare const MARIVO_DATASOURCE_TEST_TOOL_NAME = "marivo_datasource_test";
-interface JsonObject {
-    [key: string]: JsonValue;
-}
-export type MarivoDatasourceTestValue = ({
-    status: 'needs-credentials';
-    name: string;
-    refs: string[];
-} & JsonObject) | ({
-    status: 'ok';
-    name: string;
-    latency_ms: number | null;
-} & JsonObject) | ({
-    status: 'failed';
-    name: string;
-    latency_ms: number | null;
-    failure: MarivoDatasourceFailure;
-    repair: MarivoDatasourceRepair;
-} & JsonObject);
-export interface MarivoDatasourceTestOptions {
-    /** Explicit validation invalidates prior access for this Agent and datasource. */
-    revokeShellLease(bridge: MarivoDatasourceBridgePort, name: string): void;
-}
-/** Build the scoped datasource connection-test Tool. */
-export declare function createMarivoDatasourceTestTool(bridgeSource: MarivoDatasourceBridgeSource, credentials: Pick<CredentialProvider, 'resolve'>, options: MarivoDatasourceTestOptions): ToolDefinition;
-export declare function registerMarivoDatasourceTestTool(ctx: Context, bridgeSource: MarivoDatasourceBridgeSource, credentials: Pick<CredentialProvider, 'resolve'>, options: MarivoDatasourceTestOptions): () => void;
-export {};
+export declare function createMarivoDatasourceTestTool(source: MarivoDatasourceBridgeSource, service: MarivoCredentialService): ToolDefinition;
+export declare function registerMarivoDatasourceTestTool(ctx: Context, source: MarivoDatasourceBridgeSource, service: MarivoCredentialService): () => void;
+/** Preserve the datasource tools' public status family; raw Marivo results stay inside the service. */
+export declare function datasourceToolValue(result: Awaited<ReturnType<MarivoCredentialService['prepare']>>): any;

package/lib/types/environment/binding.d.ts

@@ -16,11 +16,15 @@ export declare class MarivoEnvironment {
     assertImportIdentity(signal?: AbortSignal): Promise<ImportIdentity>;
 }
 /** Build an identity-checked Help runner directly from an admitted shared Runtime. */
-export declare function createSharedMarivoRuntimeRunner(runtime: Pick<SharedMarivoRuntime, 'runtimeRoot' | 'pythonExecutable' | 'marivoVersion' | 'packagePath'>, options?: {
+export declare function createSharedMarivoRuntimeRunner(runtime: Pick<SharedMarivoRuntime, 'runtimeRoot' | 'pythonExecutable' | 'marivoVersion' | 'packagePath' | 'presentationKitVersion' | 'presentationKitPackagePath'>, options?: {
     environment?: NodeJS.ProcessEnv;
 }): MarivoEnvironment;
 /** Resolve, probe, and establish one Marivo Environment Binding. */
 export declare function bindMarivoEnvironment(config: MarivoEnvironmentConfig, options?: {
     environment?: NodeJS.ProcessEnv;
     signal?: AbortSignal;
+    presentationKit?: Readonly<{
+        version: string;
+        packagePath: string;
+    }>;
 }): Promise<MarivoEnvironment>;

package/lib/types/environment/errors.d.ts

@@ -1,4 +1,4 @@
-export type EnvironmentFailureCode = 'project-root-invalid' | 'python-path-relative' | 'python-unavailable' | 'shared-runtime-config-invalid' | 'shared-runtime-lock-timeout' | 'shared-runtime-install-failed' | 'shared-runtime-identity-mismatch' | 'shared-runtime-version-unsupported' | 'shared-runtime-pandas-unsupported' | 'shared-runtime-report-kit-unsupported' | 'shared-runtime-report-kit-wheel-invalid' | 'shared-runtime-report-kit-wheel-unavailable' | 'shared-runtime-package-unavailable' | 'shared-runtime-skills-invalid' | 'subprocess-start-failed' | 'subprocess-timeout' | 'subprocess-cancelled' | 'subprocess-output-limit' | 'subprocess-output-invalid' | 'subprocess-failed' | 'datasource-credential-ref-invalid' | 'datasource-credential-resolve-failed' | 'shell-credential-lease-invalid' | 'shell-credential-lease-expired' | 'shell-credential-lease-exhausted' | 'shell-credential-lease-scope-mismatch' | 'shell-credential-lease-resolve-failed' | 'shell-credential-injection-unsupported' | 'doctor-json-invalid' | 'doctor-admission-failed' | 'binding-identity-mismatch' | 'binding-failed';
+export type EnvironmentFailureCode = 'project-root-invalid' | 'python-path-relative' | 'python-unavailable' | 'shared-runtime-config-invalid' | 'shared-runtime-lock-timeout' | 'shared-runtime-install-failed' | 'shared-runtime-identity-mismatch' | 'shared-runtime-version-unsupported' | 'shared-runtime-pandas-unsupported' | 'shared-runtime-presentation-kit-unsupported' | 'shared-runtime-presentation-kit-wheel-invalid' | 'shared-runtime-presentation-kit-wheel-unavailable' | 'shared-runtime-package-unavailable' | 'shared-runtime-skills-invalid' | 'subprocess-start-failed' | 'subprocess-timeout' | 'subprocess-cancelled' | 'subprocess-output-limit' | 'subprocess-output-invalid' | 'subprocess-failed' | 'datasource-credential-ref-invalid' | 'datasource-credential-resolve-failed' | 'shell-credential-lease-invalid' | 'shell-credential-lease-expired' | 'shell-credential-lease-exhausted' | 'shell-credential-lease-scope-mismatch' | 'shell-credential-lease-resolve-failed' | 'shell-credential-injection-unsupported' | 'doctor-json-invalid' | 'doctor-admission-failed' | 'binding-identity-mismatch' | 'binding-failed';
 /** Stable failure envelope for config, subprocess, doctor, and identity errors. */
 export declare class MarivoEnvironmentError extends Error {
     readonly code: EnvironmentFailureCode;

package/lib/types/environment/runtime.d.ts

@@ -1,16 +1,16 @@
 import type { SharedMarivoRuntime, SharedMarivoRuntimeConfig } from './types.ts';
 export declare const SHARED_PYTHON_SPEC = "3.10";
 export declare const SHARED_MARIVO_PACKAGE_SPEC: string;
-export declare const REPORT_KIT_DISTRIBUTION = "dsh-data-analysis-report-kit";
-export declare const REPORT_KIT_VERSION = "3.0.0";
-export declare const REPORT_KIT_PANDAS_RANGE = ">=2.2.0,<3.0.0";
-export declare const REPORT_KIT_WHEEL_FILENAME = "dsh_data_analysis_report_kit-3.0.0-py3-none-any.whl";
+export declare const PRESENTATION_KIT_DISTRIBUTION = "dsh-data-analysis-presentation-kit";
+export declare const PRESENTATION_KIT_VERSION = "1.1.0";
+export declare const PRESENTATION_KIT_PANDAS_RANGE = ">=2.2.0,<3.0.0";
+export declare const PRESENTATION_KIT_WHEEL_FILENAME = "dsh_data_analysis_presentation_kit-1.1.0-py3-none-any.whl";
 export declare const DEFAULT_SHARED_RUNTIME_INSTALL_TIMEOUT_MS = 600000;
 interface RuntimeInstallOptions {
     environment?: NodeJS.ProcessEnv;
     waitIntervalMs?: number;
     /** Test/build seam; production always resolves the wheel distributed beside the plugin. */
-    reportKitWheelPath?: string;
+    presentationKitWheelPath?: string;
 }
 /** Ensure and validate the one DSH-home-owned Marivo installation. */
 export declare function ensureSharedMarivoRuntime(config?: SharedMarivoRuntimeConfig, options?: RuntimeInstallOptions): Promise<SharedMarivoRuntime>;

package/lib/types/environment/types.d.ts

@@ -16,8 +16,8 @@ export interface SharedMarivoRuntime {
     pythonExecutable: string;
     marivoVersion: string;
     packagePath: string;
-    reportKitVersion: string;
-    reportKitPackagePath: string;
+    presentationKitVersion: string;
+    presentationKitPackagePath: string;
     skillsRoot: string;
     installationPath: string;
 }
@@ -50,6 +50,11 @@ export interface MarivoEnvironmentBinding {
     pythonExecutable: string;
     marivoVersion: string;
     packagePath: string;
+    /** Present only for bindings admitted through the shared presentation Runtime. */
+    presentationKit?: Readonly<{
+        version: string;
+        packagePath: string;
+    }>;
     subprocessPolicyId: string;
     fingerprint: string;
 }
@@ -60,6 +65,8 @@ export interface SubprocessLimits {
     terminateGraceMs: number;
 }
 export interface SubprocessRequest {
+    /** Host-only pipe input. Never part of argv or the environment. */
+    stdin?: string;
     executable: string;
     args: readonly string[];
     /** Per-call environment values layered over the frozen binding snapshot. */
@@ -69,6 +76,10 @@ export interface SubprocessRequest {
 }
 /** One identity-checked Python operation executed by a bound Environment. */
 export interface MarivoCheckedRunRequest {
+    /** Host-only pipe input; callers own its short operation lifetime. */
+    stdin?: string;
+    /** Values to redact from captured output, never passed through the environment. */
+    secretValues?: readonly string[];
     program: string;
     args?: readonly string[];
     /** Per-operation values; every non-empty value is redacted from captured output. */

package/lib/types/index.d.ts

@@ -4,6 +4,6 @@ export * from './compatibility.ts';
 export * from './datasource/index.ts';
 export * from './disclosure/index.ts';
 export * from './environment/index.ts';
-export * from './evidence/index.ts';
 export type { Config as PluginConfig } from './plugin.ts';
 export { apply, Config, inject, installMarivoPlugin, name } from './plugin.ts';
+export * from './presentation/index.ts';

package/lib/types/plugin.d.ts

@@ -1,8 +1,8 @@
 /** Cordis lifecycle adapter for the Web-profile shared Marivo Runtime. */
 import type { Context } from '@deepseek-ai/cordis';
 import type { Agent } from '@deepseek-ai/dsh-agent';
-import type { CredentialProvider } from '@deepseek-ai/dsh-credentials';
 import z from '@deepseek-ai/schemastery';
+import { type CredentialStore, MarivoCredentialService } from './datasource/service.ts';
 import { type MarivoHelpBridgeSource } from './disclosure/bridge.ts';
 import { type MarivoDisclosureOptions } from './disclosure/index.ts';
 import { MarivoEnvironment } from './environment/index.ts';
@@ -11,10 +11,9 @@ export declare const name = "dsh-data-analysis";
 /** Services that must exist before the plugin binds and watches Agent scopes. */
 export declare const inject: string[];
 export declare const MARIVO_DATASOURCE_CREDENTIAL_PROMPT: string;
-export declare const MARIVO_EVIDENCE_SOURCES_PROMPT: string;
-export declare const MARIVO_REPORT_PROMPT: string;
 /** Loader-safe configuration for the shared Runtime and per-Workspace bindings. */
 export interface Config {
+    readonly credentialInteraction?: 'web' | 'none';
     /** Explicit project root override; otherwise each Agent uses session.header.cwd. */
     readonly projectRoot?: string;
     /** Administrator-provided shared interpreter; must already contain an importable Marivo. */
@@ -35,9 +34,16 @@ export type MarivoPluginEnvironmentResolver = (agent: Agent) => MarivoEnvironmen
  */
 export declare function installMarivoPlugin(ctx: Context, environmentOrResolver: MarivoEnvironment | MarivoPluginEnvironmentResolver, options?: MarivoDisclosureOptions & {
     /** Override used by focused tests; normal plugin installation uses ctx.credentials. */
-    credentials?: Pick<CredentialProvider, 'resolve'>;
+    credentials?: CredentialStore;
+    credentialService?: MarivoCredentialService;
+    credentialInteraction?: 'web' | 'none';
     /** Runtime-scoped Help source; normal plugin installation never binds Help to a Workspace. */
     helpBridgeSource?: MarivoHelpBridgeSource;
 }): () => void;
+/** Resolve only Harness-owned, header-validated Workspace membership; never infer it from a path. */
+export declare function resolvePresentationWorkspace(ctx: Context, sessionId: string): {
+    id: string;
+    path: string;
+};
 /** Ensure the shared Runtime once, mount its skills, then bind each Workspace lazily. */
-export declare function apply(ctx: Context, config?: Config): Promise<() => void>;
+export declare function apply(ctx: Context, config?: Config): Promise<() => Promise<void>>;

package/lib/types/presentation/build/index.d.ts

@@ -0,0 +1,11 @@
+import { type PresentationDocument } from '../contracts/index.ts';
+export interface BuiltPresentation {
+    document: PresentationDocument;
+    documentBytes: Buffer;
+    htmlBytes: Buffer;
+}
+/**
+ * Render an S2 snapshot without reading source data, generating identity, or writing files.
+ * Both renderers are built into the installed package; execution needs no build tooling.
+ */
+export declare function buildPresentation(value: PresentationDocument): Promise<BuiltPresentation>;

package/lib/types/presentation/commit.d.ts

@@ -0,0 +1,4 @@
+import type { BuiltPresentation } from './build/index.ts';
+import { type PresentationReceipt } from './contracts/index.ts';
+/** Owns only one newly-created build. A single directory rename publishes both complete files. */
+export declare function commitPresentation(workspaceRoot: string, input: BuiltPresentation, assertOwner: () => Promise<void>, signal?: AbortSignal): Promise<PresentationReceipt>;

package/lib/types/presentation/contracts/charts.d.ts

@@ -0,0 +1,13 @@
+import { type ChartType, type ChartView, type TypedDataset } from './types.ts';
+export type { ChartBindings, ChartOptions, ChartType, ChartView } from './types.ts';
+export declare const CHART_TYPES: readonly ["line", "area", "stackedArea", "sparkline", "bar", "horizontalBar", "stackedBar", "stackedBar100", "horizontalStackedBar", "horizontalStackedBar100", "histogram", "boxPlot", "scatter", "heatmap", "pie", "leaderboard", "funnel", "waterfall"];
+export declare const CHART_LABELS: Record<ChartType, string>;
+/** Strictly validates one binding. A containing block handles id/kind/preparedViews. */
+export declare function parseChartViewShape(value: unknown, path?: string): asserts value is ChartView;
+/** Exact source columns, including every auxiliary field used by geometry or tooltip. */
+export declare function chartColumns(view: ChartView): string[];
+export declare function chartSeriesFields(view: ChartView): string[];
+/** Verifies supplied values only: never bins, ranks, accumulates, normalizes or sorts. */
+export declare function validateChartView(view: ChartView, dataset: TypedDataset, path?: string, dataPath?: string, rowIndices?: readonly number[]): void;
+/** Changes geometry only. Statistical views must be declared with prepared bindings. */
+export declare function chartTransition(view: ChartView, chart: ChartType, dataset: TypedDataset): ChartView | undefined;