@chengxianglibra/dsh-data-analysis 0.1.2 → 0.2.1

package/lib/types/client/right-tabs/page.d.ts

@@ -0,0 +1,36 @@
+import type { PresentationReceipt } from '../../presentation/contracts/types.ts';
+import { CredentialClientModel } from '../credentials/model.ts';
+import { ReportCatalogModel } from '../presentation/catalog-model.ts';
+import { PresentationDeliveryModel, type PresentationRpc } from '../presentation/delivery-model.ts';
+import type { ReaderViewMemory } from '../presentation/reader.tsx';
+import { SemanticBrowserModel } from '../semantic-browser/model.ts';
+import type { Directory, Resource } from './navigation.ts';
+export type PageTarget = Resource | {
+    kind: Directory;
+    workspaceId: string;
+};
+export interface PageState {
+    error?: string;
+    notice?: string;
+    newer?: PresentationReceipt;
+}
+/** Lifetime belongs to a Host tab occurrence, never to a React body mount. */
+export declare class TabPage {
+    #private;
+    readonly sessionId: string;
+    readonly target: PageTarget;
+    readonly reader: PresentationDeliveryModel;
+    readonly catalog: ReportCatalogModel;
+    readonly semantic: SemanticBrowserModel;
+    readonly datasources: CredentialClientModel;
+    readonly viewMemory: ReaderViewMemory;
+    constructor(sessionId: string, target: PageTarget, rpc: PresentationRpc, occurrenceId?: string);
+    getSnapshot: () => PageState;
+    subscribe: (listener: () => void) => () => void;
+    patch(change: Partial<PageState>): void;
+    navigate(revision: number, force?: boolean, history?: boolean): Promise<void>;
+    refresh(confirmDiscard?: () => boolean): Promise<void>;
+    publicationChanged(workspaceId: string, reportId?: string): Promise<void>;
+    unavailable(message: string): void;
+    dispose(): void;
+}

package/lib/types/client/right-tabs/styles.d.ts

@@ -0,0 +1,2 @@
+/** Host-only chrome. Portable reports keep their own independent stylesheet. */
+export declare const rightTabStyles = "\n.rt-page{height:100%;width:100%;min-width:0;overflow:auto;padding:16px;box-sizing:border-box;color:var(--dsw-alias-label-primary,#182a33);background:var(--dsw-alias-bg-base,#fff);container-type:inline-size;font:14px/1.6 system-ui,sans-serif}\n.rt-page *{box-sizing:border-box}.rt-page h2{font-size:18px;overflow-wrap:anywhere}.rt-page .rt-heading{margin:0 0 4px}.rt-heading-row{display:flex;align-items:center;justify-content:space-between;gap:16px;margin-bottom:4px}.rt-page .rt-heading-row .rt-heading{margin:0}.rt-heading-row>button{flex:none}.rt-caption{color:var(--dsw-alias-label-secondary,#627580);font-size:12px;margin:0 0 16px;overflow-wrap:anywhere}\n.rt-toolbar{display:flex;flex-wrap:wrap;align-items:center;gap:8px;padding-bottom:12px;border-bottom:1px solid var(--dsw-alias-border-l2,#dce4e8);margin-bottom:16px}\n.rt-page button,.rt-page select,.rt-page input{font:inherit;color:inherit;max-width:100%}.rt-page button{cursor:pointer;border:1px solid var(--dsw-alias-border-l2,#dce4e8);background:var(--dsw-alias-bg-base,#fff);border-radius:7px;padding:6px 10px}.rt-page button:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover,#edf4f3)}.rt-page button:disabled{opacity:.5;cursor:default}.rt-page :focus-visible{outline:2px solid var(--dsw-alias-state-business-primary,#087b70);outline-offset:3px}\n.rt-page select{padding:8px;border:1px solid var(--dsw-alias-border-l2,#dce4e8);border-radius:7px;background:var(--dsw-alias-bg-base,#fff)}.rt-page [role=alert]{color:var(--dsw-alias-state-warn-label,#b14927);overflow-wrap:anywhere}.rt-notice{padding:12px;border:1px solid var(--dsw-alias-border-l2,#dce4e8);border-radius:8px;background:var(--dsw-alias-bg-module-platform,#f5f7f9)}\n.rt-page .pd-catalog{padding:0;overflow:auto}.rt-page .pd-history{position:static;max-height:300px;border:1px solid var(--dsw-alias-border-l2,#dce4e8);border-radius:8px;margin-bottom:16px;width:100%}\n.rt-page .rt-refresh{display:grid;place-items:center;padding:7px;border-color:transparent;background:transparent}\n@container(max-width:650px){.rt-page .pr-reader{padding:24px 4px}.rt-page .pr-reader h1{font-size:25px}.rt-page .pr-block-metric{padding:14px}.rt-page .pr-metric-value{font-size:clamp(18px,7cqi,30px)}}\n";

package/lib/types/client/rpc.d.ts

@@ -0,0 +1,3 @@
+/** Keep feature RPC names while using Harness's authenticated shared API transport. */
+import type { ClientConnectionRpc } from '@deepseek-ai/dsh-client-connection/client';
+export declare function createPluginRpc(rpc: ClientConnectionRpc): ClientConnectionRpc;

package/lib/types/client/semantic-reference.d.ts

@@ -0,0 +1,4 @@
+import type { ReferenceInsert } from '@deepseek-ai/dsh-client-ui-conversation/client';
+import { type Envelope } from '../semantic-reference/contracts.ts';
+/** Both the @ picker and semantic details insert exactly this Host reference. */
+export declare function semanticReference(envelope: Envelope): ReferenceInsert;

package/lib/types/client/settings/card.d.ts

@@ -0,0 +1,9 @@
+import type { SettingsScope } from '@deepseek-ai/dsh-client-ui-settings/client';
+export interface PythonSettingsValue {
+    pythonTimeoutMs: number;
+}
+/** Seconds in the form, exact integer milliseconds at the Host boundary. */
+export declare function timeoutMilliseconds(text: string): number | undefined;
+export declare function PythonSettingsCard({ scope }: {
+    scope: SettingsScope<PythonSettingsValue>;
+}): import("react").JSX.Element | null;

package/lib/types/client/settings/install.d.ts

@@ -0,0 +1,2 @@
+import type { Context } from '@deepseek-ai/cordis';
+export declare function installSettings(ctx: Context): void;

package/lib/types/client/workspace-header-action.d.ts

@@ -1,6 +1,6 @@
 export declare function WorkspaceHeaderAction({ label, icon, disabled, title, onClick, }: {
     label: string;
-    icon: 'semantic' | 'credentials';
+    icon: 'semantic' | 'credentials' | 'reports';
     disabled: boolean;
     title?: string;
     onClick: () => void;

package/lib/types/client/workspace-shortcuts.d.ts

@@ -0,0 +1,15 @@
+import type { SessionSnapshot } from '@deepseek-ai/dsh-api-session-controller/client';
+import { type ConversationSnapshot } from '@deepseek-ai/dsh-client-ui-conversation/client';
+export declare const workspaceDirectories: {
+    readonly datasources: "marivo.credentials.datasources-and-credentials";
+    readonly semantic: "marivo.navigation.semantic-layer";
+    readonly reports: "marivo.presentation.reports";
+};
+export type WorkspaceDirectory = keyof typeof workspaceDirectories;
+/** Only the Host's blank phase exposes preparation actions; drafts are untouched. */
+export declare function WorkspaceShortcuts({ session, conversation, disabled, open, }: {
+    session?: SessionSnapshot;
+    conversation?: ConversationSnapshot;
+    disabled: boolean;
+    open: (page: WorkspaceDirectory) => void;
+}): import("react").JSX.Element | null;

package/lib/types/client.d.ts

@@ -1,7 +1,10 @@
 import type { Context } from '@deepseek-ai/cordis';
+import { installRightTabs } from './client/right-tabs/install.tsx';
 export { marivoPresentationDeliveryDefinition, parsePresentationDurableContent, presentationDeliveryFromEvent, presentationsForNode, } from './client/presentation/delivery.ts';
 export { PresentationDeliveryModel } from './client/presentation/delivery-model.ts';
 export { HostPresentationReader } from './client/presentation/host-entry.tsx';
-export { installPresentation, PresentationCards, PresentationOverlay, } from './client/presentation/install.tsx';
 export declare const inject: string[];
-export declare function apply(ctx: Context): void;
+export declare function apply(ctx: Context, options?: {
+    diagnostics?: boolean;
+    onInstalled?: (controller: ReturnType<typeof installRightTabs>) => void;
+}): void;

package/lib/types/compatibility.d.ts

@@ -17,7 +17,7 @@ export interface DshDataAnalysisCompatibility {
 /** The package semver and the compatibility contract shipped in this exact installation. */
 export declare const PLUGIN_VERSION: string;
 export declare const DSH_DATA_ANALYSIS_COMPATIBILITY: DshDataAnalysisCompatibility;
-/** Every DSH peer is required and must use this one verified release. */
+/** Every DSH peer is required and must satisfy this declared compatibility range. */
 export declare const DSH_PEER_RANGE: string;
 export declare const DSH_DISTRIBUTION: "@deepseek-ai/dsh";
 export declare const DSH_PEER_DEPENDENCIES: Readonly<{

package/lib/types/datasource/authoring.d.ts

@@ -18,6 +18,16 @@ export declare const datasourceAuthoringSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type DatasourceAuthoring = z.infer<typeof datasourceAuthoringSchema>;
+export interface DatasourceConfiguration {
+    name: string;
+    backend: string;
+    fields: Record<string, unknown>;
+    version: string;
+}
+export interface DatasourceUpdateInput extends DatasourceCreateInput {
+    name: string;
+    version: string;
+}
 export interface DatasourceCreateInput {
     backend: string;
     fields: Record<string, unknown>;

package/lib/types/datasource/bridge.d.ts

@@ -1,7 +1,7 @@
-import type { JsonValue } from '@deepseek-ai/dsh-session';
+import type { JsonValue } from '@deepseek-ai/dsh-util-values';
 import type { MarivoBridgeSource } from '../environment/source.ts';
 import type { MarivoCheckedRunner, MarivoEnvironmentBinding } from '../environment/types.ts';
-import { type DatasourceAuthoring, type DatasourceCreateInput } from './authoring.ts';
+import { type DatasourceAuthoring, type DatasourceConfiguration, type DatasourceCreateInput, type DatasourceUpdateInput } from './authoring.ts';
 interface JsonObject {
     [key: string]: JsonValue;
 }
@@ -40,11 +40,20 @@ export interface MarivoDatasourceTestResult {
 }
 export interface MarivoDatasourceBridgePort {
     readonly binding: Readonly<MarivoEnvironmentBinding>;
+    remove?(description: Readonly<MarivoDatasourceDescription>, signal?: AbortSignal): Promise<{
+        name?: string;
+        error?: string;
+    }>;
     authoring?(signal?: AbortSignal): Promise<DatasourceAuthoring>;
     create?(input: DatasourceCreateInput, signal?: AbortSignal): Promise<{
         name?: string;
         error?: string;
     }>;
+    configuration?(name: string, signal?: AbortSignal): Promise<DatasourceConfiguration>;
+    update?(input: DatasourceUpdateInput, signal?: AbortSignal): Promise<{
+        name?: string;
+        error?: string;
+    }>;
     describe(name: string, signal?: AbortSignal): Promise<MarivoDatasourceDescription>;
     inventory(signal?: AbortSignal): Promise<MarivoDatasourceDescription[]>;
     test(description: Readonly<MarivoDatasourceDescription>, values: Readonly<Record<string, string>>, signal?: AbortSignal): Promise<MarivoDatasourceTestResult>;
@@ -58,11 +67,23 @@ export declare class MarivoDatasourceBridge {
     readonly binding: Readonly<MarivoEnvironmentBinding>;
     constructor(runner: MarivoCheckedRunner);
     authoring(signal?: AbortSignal): Promise<DatasourceAuthoring>;
+    configuration(name: string, signal?: AbortSignal): Promise<DatasourceConfiguration>;
+    update(input: DatasourceUpdateInput, signal?: AbortSignal): Promise<{
+        name?: string;
+        error?: string;
+    }>;
     create(input: DatasourceCreateInput, signal?: AbortSignal): Promise<{
         name?: string;
         error?: string;
     }>;
     describe(name: string, signal?: AbortSignal): Promise<MarivoDatasourceDescription>;
+    remove(description: Readonly<MarivoDatasourceDescription>, signal?: AbortSignal): Promise<{
+        error: string;
+        name?: undefined;
+    } | {
+        name: string;
+        error?: undefined;
+    }>;
     inventory(signal?: AbortSignal): Promise<MarivoDatasourceDescription[]>;
     test(description: Readonly<MarivoDatasourceDescription>, values: Readonly<Record<string, string>>, signal?: AbortSignal): Promise<MarivoDatasourceTestResult>;
 }

package/lib/types/datasource/changes-contract.d.ts

@@ -0,0 +1,18 @@
+import type { TypertRemoteContribution } from '@deepseek-ai/dsh-typert-protocol';
+import type { TypertContribution } from '@deepseek-ai/dsh-typert-registry';
+import { z } from 'zod';
+export declare const CREDENTIAL_CHANGES_SERVICE = "dshDataAnalysisCredentials";
+export declare const credentialRevisionSchema: z.ZodObject<{
+    generation: z.ZodString;
+    cursor: z.ZodString;
+}, z.core.$strict>;
+export type CredentialRevision = z.infer<typeof credentialRevisionSchema>;
+export declare const credentialChangesHost: TypertContribution;
+export declare const credentialChangesRemote: TypertRemoteContribution;
+declare module '@deepseek-ai/dsh-typert-protocol' {
+    interface TypertRemoteNamespaceMap {
+        dshDataAnalysisCredentials: {
+            changes(sessionId: string, signal?: AbortSignal): AsyncIterable<CredentialRevision>;
+        };
+    }
+}

package/lib/types/datasource/changes.d.ts

@@ -0,0 +1,15 @@
+import type { Context } from '@deepseek-ai/cordis';
+import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
+import { type CredentialRevision } from './changes-contract.ts';
+import { type MarivoCredentialService } from './service.ts';
+/** Reuses the Host's logical stream carrier; credentials and waiting calls keep their owner. */
+export declare class CredentialChangesService extends TypertRemoteService {
+    private readonly credentials;
+    private readonly lifetime;
+    private readonly tasks;
+    private closing?;
+    constructor(ctx: Context, credentials: Pick<MarivoCredentialService, 'waitWatch'>);
+    changes(sessionId: string, caller: AbortSignal): AsyncIterable<CredentialRevision>;
+    private snapshot;
+    close(): Promise<void>;
+}

package/lib/types/datasource/configure.d.ts

@@ -0,0 +1,7 @@
+import type { Context } from '@deepseek-ai/cordis';
+import { type ToolDefinition } from '@deepseek-ai/dsh-tools';
+import { type MarivoDatasourceBridgeSource } from './bridge.ts';
+import type { MarivoCredentialService } from './service.ts';
+export declare const MARIVO_DATASOURCE_CONFIGURE_TOOL_NAME = "marivo_datasource_configure";
+export declare function createMarivoDatasourceConfigureTool(source: MarivoDatasourceBridgeSource, service: MarivoCredentialService): ToolDefinition;
+export declare function registerMarivoDatasourceConfigureTool(ctx: Context, source: MarivoDatasourceBridgeSource, service: MarivoCredentialService): () => Promise<void>;

package/lib/types/datasource/defaults.d.ts

@@ -0,0 +1,7 @@
+import type { DatasourceAuthoring } from './authoring.ts';
+export type DatasourceDefaults = Record<string, Record<string, unknown>>;
+export type DatasourceAuthoringView = DatasourceAuthoring & {
+    creationDefaults?: DatasourceDefaults;
+};
+/** Validate against this Workspace's live Runtime; never include config values in errors. */
+export declare function withDatasourceDefaults(schema: DatasourceAuthoring, configured: unknown): DatasourceAuthoringView;

package/lib/types/datasource/index.d.ts

@@ -1,6 +1,11 @@
+export type { DatasourceConfiguration, DatasourceUpdateInput } from './authoring.ts';
 export type { MarivoDatasourceBridgePort, MarivoDatasourceBridgeSource, MarivoDatasourceDescription, MarivoDatasourceFailure, MarivoDatasourceInventoryBridge, MarivoDatasourceInventoryBridgeSource, MarivoDatasourceRepair, MarivoDatasourceTestResult, } from './bridge.ts';
 export { MarivoDatasourceBridge, resolveMarivoDatasourceBridge, resolveMarivoDatasourceInventoryBridge, } from './bridge.ts';
-export { registerMarivoPythonTool } from './python.ts';
+export { createMarivoDatasourceConfigureTool, MARIVO_DATASOURCE_CONFIGURE_TOOL_NAME, registerMarivoDatasourceConfigureTool, } from './configure.ts';
+export type { MarivoPythonExecutionSummary } from './python.ts';
+export { MarivoPythonExecutionError, registerMarivoPythonTool } from './python.ts';
+export type { MarivoPythonOptions } from './python-options.ts';
+export type { ConfigurationRequestView, ConfigurationResult, DatasourceConfigureInput, } from './service.ts';
 export { MarivoCredentialService } from './service.ts';
 export { assertMarivoCredentialReferences, MARIVO_CREDENTIAL_STORAGE_PREFIX, marivoCredentialStorageRef, } from './shell-env.ts';
 export { createMarivoDatasourceTestTool, MARIVO_DATASOURCE_TEST_TOOL_NAME, registerMarivoDatasourceTestTool, } from './test.ts';

package/lib/types/datasource/python-options.d.ts

@@ -0,0 +1,8 @@
+export declare const DEFAULT_PYTHON_TIMEOUT_MS = 120000;
+export interface MarivoPythonOptions {
+    pythonTimeoutMs?: number;
+}
+export type MarivoPythonOptionsSource = MarivoPythonOptions | (() => MarivoPythonOptions);
+/** Do not echo rejected inputs: tool arguments and configuration are not trusted diagnostics. */
+export declare function pythonTimeout(value: unknown, name: string): number;
+export declare function resolvePythonOptions(options: MarivoPythonOptions): Required<MarivoPythonOptions>;

package/lib/types/datasource/python.d.ts

@@ -1,4 +1,19 @@
 import type { Context } from '@deepseek-ai/cordis';
 import { type MarivoDatasourceBridgeSource } from './bridge.ts';
-import type { MarivoCredentialService } from './service.ts';
-export declare function registerMarivoPythonTool(ctx: Context, source: MarivoDatasourceBridgeSource, service: MarivoCredentialService): () => void;
+import { type MarivoPythonOptionsSource } from './python-options.ts';
+import { type MarivoCredentialService } from './service.ts';
+export interface MarivoPythonExecutionSummary {
+    phase: 'preparing' | 'executing' | 'capturing-code';
+    reason: 'not-started' | 'succeeded' | 'nonzero-exit' | 'timed-out' | 'cancelled' | 'unknown';
+    requestedTimeoutMs: number | null;
+    effectiveTimeoutMs: number | null;
+    elapsedMs: number;
+    executionElapsedMs: number | null;
+    nextAction: string | null;
+}
+/** The message survives Harness error normalization; it contains only safe adapter facts. */
+export declare class MarivoPythonExecutionError extends Error {
+    readonly execution: MarivoPythonExecutionSummary;
+    constructor(message: string, execution: MarivoPythonExecutionSummary);
+}
+export declare function registerMarivoPythonTool(ctx: Context, source: MarivoDatasourceBridgeSource, service: MarivoCredentialService, options?: MarivoPythonOptionsSource): () => Promise<void>;

package/lib/types/datasource/rpc.d.ts

@@ -1,4 +1,5 @@
 import type { HostConnectionHandle } from '@deepseek-ai/dsh-client-connection';
 import type { MarivoDatasourceBridgePort } from './bridge.ts';
+import { type DatasourceDefaults } from './defaults.ts';
 import { type MarivoCredentialService } from './service.ts';
-export declare function registerCredentialRpc(connection: HostConnectionHandle, service: MarivoCredentialService, workspace: (id: string) => Promise<MarivoDatasourceBridgePort>): () => Promise<void>;
+export declare function registerCredentialRpc(connection: HostConnectionHandle, service: MarivoCredentialService, workspace: (id: string) => Promise<MarivoDatasourceBridgePort>, datasourceDefaults?: DatasourceDefaults): () => Promise<void>;

package/lib/types/datasource/service.d.ts

@@ -1,12 +1,12 @@
 import type { Agent } from '@deepseek-ai/dsh-agent';
 import { type CredentialProvider } from '@deepseek-ai/dsh-credentials';
-import type { JsonValue } from '@deepseek-ai/dsh-session';
 import type { ToolExecution } from '@deepseek-ai/dsh-tools';
-import type { DatasourceCreateInput } from './authoring.ts';
+import type { JsonValue } from '@deepseek-ai/dsh-util-values';
+import type { DatasourceCreateInput, DatasourceUpdateInput } from './authoring.ts';
 import type { MarivoDatasourceBridgePort, MarivoDatasourceDescription, MarivoDatasourceTestResult } from './bridge.ts';
 export declare const CREDENTIAL_CHANNEL = "/dsh-data-analysis-credentials";
 export type CredentialStore = Pick<CredentialProvider, 'describe' | 'resolve' | 'set' | 'unset'>;
-export type CredentialAction = 'save' | 'update' | 'delete' | 'test' | 'submit' | 'diagnose';
+export type CredentialAction = 'save' | 'update' | 'delete' | 'delete-datasource' | 'test' | 'submit' | 'diagnose';
 export interface CredentialContextView {
     token: string;
     workspaceId: string;
@@ -31,16 +31,49 @@ export interface CredentialRequestView {
     id: string;
     sessionId: string;
     context: CredentialContextView;
-    status: 'awaiting-input' | 'executing' | 'awaiting-decision' | 'succeeded' | 'handed-off' | 'call-ended' | 'context-changed';
+    status: 'awaiting-input' | 'executing' | 'awaiting-decision' | 'succeeded' | 'handed-off' | 'call-ended' | 'cancelled' | 'context-changed';
     failure?: MarivoDatasourceTestResult;
     endedAt?: number;
 }
+export interface DatasourceConfigureInput {
+    mode: 'create' | 'edit';
+    name?: string;
+    reason: string;
+}
+export interface ConfigurationRequestView extends Omit<CredentialRequestView, 'context'> {
+    configuration: DatasourceConfigureInput;
+    workspaceId: string;
+    context?: CredentialContextView;
+}
+interface PendingConfiguration {
+    view: ConfigurationRequestView;
+    settled: boolean;
+    controller: AbortController;
+    exec: ToolExecution;
+    resolve: () => Promise<MarivoDatasourceBridgePort>;
+    fingerprint: string;
+    sessionIdentity: string;
+    signal: AbortSignal;
+    finish: (value: ConfigurationResult) => void;
+    stop: () => void;
+}
+export interface ConfigurationResult {
+    status: 'ok' | 'failed' | 'cancelled' | 'call-ended' | 'context-changed' | 'needs-configuration';
+    name?: string;
+    latency_ms?: number | null;
+    failure?: MarivoDatasourceTestResult['failure'];
+    repair?: MarivoDatasourceTestResult['repair'];
+}
 export interface CredentialOperationView {
     id: string;
     scope: string;
     action: CredentialAction;
     status: 'running' | 'succeeded' | 'failed' | 'cancelled';
-    phase: 'saving' | 'validating' | 'settled';
+    phase: 'saving' | 'removing' | 'validating' | 'settled';
+    deleteCredentials?: boolean;
+    datasourceRemoved?: boolean;
+    deletedCredentials?: string[];
+    credentialDeleteFailures?: string[];
     saved: string[];
     errors: string[];
     result?: MarivoDatasourceTestResult;
@@ -81,17 +114,25 @@ export declare class MarivoCredentialService {
     createDatasource(generation: string, fingerprint: string, input: DatasourceCreateInput, resolve: () => Promise<MarivoDatasourceBridgePort>, caller: AbortSignal): Promise<{
         name: string;
     }>;
+    updateDatasource(generation: string, fingerprint: string, input: DatasourceUpdateInput, resolve: () => Promise<MarivoDatasourceBridgePort>, caller: AbortSignal): Promise<{
+        name: string;
+    }>;
+    configure(exec: ToolExecution, resolve: () => Promise<MarivoDatasourceBridgePort>, input: DatasourceConfigureInput): Promise<ConfigurationResult>;
+    configurationRequest(id: string, workspaceId: string, resolve: () => Promise<MarivoDatasourceBridgePort>, caller: AbortSignal): Promise<PendingConfiguration>;
+    selectConfiguration(id: string, workspaceId: string, name: string, resolve: () => Promise<MarivoDatasourceBridgePort>, caller: AbortSignal): Promise<ConfigurationRequestView>;
     prepare(_kind: 'test', exec: ToolExecution, resolve: () => Promise<MarivoDatasourceBridgePort>, name: string): Promise<MarivoDatasourceTestResult | CredentialNeedsInput>;
     prepareExecution(exec: ToolExecution, resolve: () => Promise<MarivoDatasourceBridgePort>, names: string[]): Promise<PreparedCredentialExecution | CredentialNeedsInput | MarivoDatasourceTestResult>;
     watch(sessionId: string, cursor?: string): {
         generation: string;
         cursor: string;
         requests: CredentialRequestView[];
+        configurationRequests: ConfigurationRequestView[];
     };
     waitWatch(sessionId: string, cursor: string | undefined, signal: AbortSignal): Promise<{
         generation: string;
         cursor: string;
         requests: CredentialRequestView[];
+        configurationRequests: ConfigurationRequestView[];
     }>;
     operation(generation: string, id: string, scope: string): CredentialOperationView | undefined;
     start(input: {
@@ -103,6 +144,7 @@ export declare class MarivoCredentialService {
         requestId?: string;
         changes?: Record<string, string>;
         reference?: string;
+        deleteCredentials?: boolean;
     }): CredentialOperationView;
     cancelOperation(generation: string, id: string, scope: string): void;
     cancelRequest(id: string): void;
@@ -110,3 +152,4 @@ export declare class MarivoCredentialService {
     track<T>(task: Promise<T>): Promise<T>;
     close(): Promise<void>;
 }
+export {};

package/lib/types/datasource/test.d.ts

@@ -4,6 +4,6 @@ import { type MarivoDatasourceBridgeSource } from './bridge.ts';
 import type { MarivoCredentialService } from './service.ts';
 export declare const MARIVO_DATASOURCE_TEST_TOOL_NAME = "marivo_datasource_test";
 export declare function createMarivoDatasourceTestTool(source: MarivoDatasourceBridgeSource, service: MarivoCredentialService): ToolDefinition;
-export declare function registerMarivoDatasourceTestTool(ctx: Context, source: MarivoDatasourceBridgeSource, service: MarivoCredentialService): () => void;
+export declare function registerMarivoDatasourceTestTool(ctx: Context, source: MarivoDatasourceBridgeSource, service: MarivoCredentialService): () => Promise<void>;
 /** Preserve the datasource tools' public status family; raw Marivo results stay inside the service. */
 export declare function datasourceToolValue(result: Awaited<ReturnType<MarivoCredentialService['prepare']>>): any;

package/lib/types/disclosure/activation.d.ts

@@ -63,11 +63,12 @@ export declare class MarivoDisclosureController {
     constructor(agent: Agent, bridgeSource: MarivoHelpBridgeSource, options?: MarivoDisclosureOptions);
     get activeSkills(): readonly MarivoSkillName[];
     telemetry(): MarivoDisclosureTelemetry;
-    addDisposer(disposer: () => void): void;
+    addDisposer(disposer: () => unknown): void;
     observeToolResult(exec: Readonly<ToolExecution>, result: Readonly<ToolExecutionResult>): void;
     resolveDelivery(query: Readonly<MarivoHelpDeliveryQuery>): MarivoHelpDelivery;
     prepareStep(messages: readonly UserMessage[], signal: AbortSignal): Promise<UserMessage[]>;
     dispose(): void;
+    close(): Promise<void>;
 }
 /** Install skill-triggered Marivo live-help disclosure for one Agent scope. */
 export declare function installMarivoDisclosure(_ctx: Context, agent: Agent, bridgeSource: MarivoHelpBridgeSource, options?: MarivoDisclosureOptions): MarivoDisclosureController;

package/lib/types/disclosure/execution-guidance.d.ts

@@ -0,0 +1,6 @@
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import type { MarivoDisclosureController } from './activation.ts';
+export declare const MARIVO_DATASOURCE_CREDENTIAL_PROMPT: string;
+export declare const MARIVO_ANALYSIS_CLOSEOUT_PROMPT: string;
+/** Full-plugin seam: requires its execution tools, credentials service and system sections. */
+export declare function installMarivoExecutionGuidance(agent: Agent, controller: MarivoDisclosureController): () => void;

package/lib/types/disclosure/help.d.ts

@@ -61,4 +61,4 @@ export declare function readMarivoHelpTargets(bridge: MarivoHelpBridgePort, rawT
 /** Build the native Harness ToolDefinition without registering Agent activation behavior. */
 export declare function createMarivoHelpTool(bridgeSource: MarivoHelpBridgeSource, limitOverrides?: Partial<MarivoHelpLimits>, resolveDelivery?: MarivoHelpDeliveryResolver): ToolDefinition;
 /** Register the focused Help Tool; skill-triggered root disclosure is composed separately. */
-export declare function registerMarivoHelpTool(ctx: Context, bridgeSource: MarivoHelpBridgeSource, limits?: Partial<MarivoHelpLimits>, resolveDelivery?: MarivoHelpDeliveryResolver): () => void;
+export declare function registerMarivoHelpTool(ctx: Context, bridgeSource: MarivoHelpBridgeSource, limits?: Partial<MarivoHelpLimits>, resolveDelivery?: MarivoHelpDeliveryResolver): () => Promise<void>;

package/lib/types/environment/types.d.ts

@@ -7,7 +7,8 @@ export interface MarivoEnvironmentConfig {
 export interface SharedMarivoRuntimeConfig {
     runtimeRoot?: string;
     pythonExecutable?: string;
-    uvExecutable?: string;
+    /** Absolute local Python for venv creation; defaults to python3 (Windows: python). */
+    bootstrapPythonExecutable?: string;
     installTimeoutMs?: number;
 }
 /** Validated identity and stable skill root of the shared Marivo installation. */

package/lib/types/environment/workspace.d.ts

@@ -6,5 +6,6 @@ export declare class MarivoWorkspaceEnvironmentManager {
     readonly runtime: SharedMarivoRuntime;
     constructor(runtime: SharedMarivoRuntime);
     resolve(projectRoot: string): Promise<MarivoEnvironment>;
+    close(): Promise<void>;
     dispose(): void;
 }

package/lib/types/lifecycle.d.ts

@@ -0,0 +1,8 @@
+/** Tracks owned work, including work whose caller stopped waiting after cancellation. */
+export declare class PendingTasks {
+    #private;
+    track<T>(task: Promise<T>): Promise<T>;
+    drain(): Promise<void>;
+}
+/** Start every stop synchronously, then await every cleanup even if another one fails. */
+export declare function finishCleanup(actions: readonly (() => unknown)[]): Promise<void>;

package/lib/types/plugin-agents.d.ts

@@ -0,0 +1,29 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import { type MarivoPythonOptions } from './datasource/python-options.ts';
+import { type CredentialStore, MarivoCredentialService } from './datasource/service.ts';
+import type { MarivoHelpBridgeSource } from './disclosure/bridge.ts';
+import { type MarivoDisclosureOptions } from './disclosure/index.ts';
+import { MarivoEnvironment } from './environment/index.ts';
+import type { ReportPublishingService } from './report-publishing/service.ts';
+export type MarivoPluginEnvironmentResolver = (agent: Agent) => MarivoEnvironment | Promise<MarivoEnvironment>;
+/**
+ * Install one already-bound environment into every live or subsequently published Agent scope.
+ * Installation is transactional for existing Agents and is disposed with the Cordis plugin.
+ */
+export declare function createMarivoAgentInstallation(ctx: Context, environmentOrResolver: MarivoEnvironment | MarivoPluginEnvironmentResolver, options?: MarivoDisclosureOptions & MarivoPythonOptions & {
+    /** Override used by focused tests; normal plugin installation uses ctx.credentials. */
+    reportPublishing?: ReportPublishingService;
+    credentials?: CredentialStore;
+    credentialService?: MarivoCredentialService;
+    credentialInteraction?: 'web' | 'none';
+    /** Read once at call admission so saved settings affect existing Agents. */
+    pythonOptionsSource?: () => MarivoPythonOptions;
+    /** Runtime-scoped Help source; normal plugin installation never binds Help to a Workspace. */
+    helpBridgeSource?: MarivoHelpBridgeSource;
+}): {
+    install(): void;
+    close: () => Promise<void>;
+};
+/** Stops synchronously; the returned Promise also waits for all owned work. */
+export declare function installMarivoPlugin(...args: Parameters<typeof createMarivoAgentInstallation>): () => Promise<void>;

package/lib/types/plugin.d.ts

@@ -1,18 +1,20 @@
-/** Cordis lifecycle adapter for the Web-profile shared Marivo Runtime. */
+import { type ReportPublishingConfig } from './report-publishing/config.ts';
+export { installMarivoPlugin, type MarivoPluginEnvironmentResolver } from './plugin-agents.ts';
+export { resolvePresentationWorkspace } from './workspace-identity.ts';
 import type { Context } from '@deepseek-ai/cordis';
-import type { Agent } from '@deepseek-ai/dsh-agent';
 import z from '@deepseek-ai/schemastery';
-import { type CredentialStore, MarivoCredentialService } from './datasource/service.ts';
-import { type MarivoHelpBridgeSource } from './disclosure/bridge.ts';
-import { type MarivoDisclosureOptions } from './disclosure/index.ts';
-import { MarivoEnvironment } from './environment/index.ts';
+import type { DatasourceDefaults } from './datasource/defaults.ts';
+import { type MarivoPythonOptions } from './datasource/python-options.ts';
+export { MARIVO_DATASOURCE_CREDENTIAL_PROMPT } from './disclosure/execution-guidance.ts';
 /** Cordis plugin name used by loader diagnostics and lifecycle logs. */
 export declare const name = "dsh-data-analysis";
 /** Services that must exist before the plugin binds and watches Agent scopes. */
 export declare const inject: string[];
-export declare const MARIVO_DATASOURCE_CREDENTIAL_PROMPT: string;
 /** Loader-safe configuration for the shared Runtime and per-Workspace bindings. */
-export interface Config {
+export interface Config extends MarivoPythonOptions {
+    readonly reportPublishing?: ReportPublishingConfig;
+    /** Non-secret creation defaults by backend; checked against each live Runtime schema. */
+    readonly datasourceDefaults?: DatasourceDefaults;
     readonly credentialInteraction?: 'web' | 'none';
     /** Explicit project root override; otherwise each Agent uses session.header.cwd. */
     readonly projectRoot?: string;
@@ -20,30 +22,12 @@ export interface Config {
     readonly pythonExecutable?: string;
     /** Shared Runtime root; defaults below $DSH_HOME. */
     readonly runtimeRoot?: string;
-    /** Local uv executable; an explicit value must be absolute. */
-    readonly uvExecutable?: string;
+    /** Local Python used to create the managed venv; an explicit value must be absolute. */
+    readonly bootstrapPythonExecutable?: string;
     /** Maximum time for installation and lock acquisition. */
     readonly installTimeoutMs?: number;
 }
 /** Cordis loader schema. Runtime defaults are resolved in {@link apply}. */
 export declare const Config: z<Config>;
-export type MarivoPluginEnvironmentResolver = (agent: Agent) => MarivoEnvironment | Promise<MarivoEnvironment>;
-/**
- * Install one already-bound environment into every live or subsequently published Agent scope.
- * Installation is transactional for existing Agents and is disposed with the Cordis plugin.
- */
-export declare function installMarivoPlugin(ctx: Context, environmentOrResolver: MarivoEnvironment | MarivoPluginEnvironmentResolver, options?: MarivoDisclosureOptions & {
-    /** Override used by focused tests; normal plugin installation uses ctx.credentials. */
-    credentials?: CredentialStore;
-    credentialService?: MarivoCredentialService;
-    credentialInteraction?: 'web' | 'none';
-    /** Runtime-scoped Help source; normal plugin installation never binds Help to a Workspace. */
-    helpBridgeSource?: MarivoHelpBridgeSource;
-}): () => void;
-/** Resolve only Harness-owned, header-validated Workspace membership; never infer it from a path. */
-export declare function resolvePresentationWorkspace(ctx: Context, sessionId: string): {
-    id: string;
-    path: string;
-};
 /** Ensure the shared Runtime once, mount its skills, then bind each Workspace lazily. */
 export declare function apply(ctx: Context, config?: Config): Promise<() => Promise<void>>;

package/lib/types/presentation/asset.d.ts

@@ -0,0 +1,6 @@
+import { type PresentationAsset, type PresentationReceipt } from './contracts/index.ts';
+/** Read a fixed, receipt-verified snapshot; never access analysis or current. */
+export declare function readReceiptAsset(root: string, workspaceId: string, receipt: PresentationReceipt, asset: PresentationAsset, signal: AbortSignal): Promise<{
+    bytes: Buffer<ArrayBufferLike>;
+    sha256: string;
+}>;

package/lib/types/presentation/build/index.d.ts

@@ -2,10 +2,15 @@ import { type PresentationDocument } from '../contracts/index.ts';
 export interface BuiltPresentation {
     document: PresentationDocument;
     documentBytes: Buffer;
-    htmlBytes: Buffer;
+    htmlBytes?: Buffer;
 }
 /**
  * Render an S2 snapshot without reading source data, generating identity, or writing files.
  * Both renderers are built into the installed package; execution needs no build tooling.
  */
-export declare function buildPresentation(value: PresentationDocument): Promise<BuiltPresentation>;
+export declare function buildPresentation(value: PresentationDocument): Promise<BuiltPresentation & {
+    htmlBytes: Buffer;
+}>;
+export declare function buildPresentation(value: PresentationDocument, options: {
+    html?: boolean;
+}): Promise<BuiltPresentation>;

package/lib/types/presentation/commit.d.ts

@@ -1,4 +1,4 @@
 import type { BuiltPresentation } from './build/index.ts';
 import { type PresentationReceipt } from './contracts/index.ts';
-/** Owns only one newly-created build. A single directory rename publishes both complete files. */
+/** Owns only one newly-created build. A single directory rename publishes all requested complete files. */
 export declare function commitPresentation(workspaceRoot: string, input: BuiltPresentation, assertOwner: () => Promise<void>, signal?: AbortSignal): Promise<PresentationReceipt>;

package/lib/types/presentation/contracts/asset-path.d.ts

@@ -0,0 +1,2 @@
+import type { PresentationAsset } from './types.ts';
+export declare function presentationAssetRelativePath(reportId: string, buildId: string, asset: PresentationAsset): string;