@chengxianglibra/dsh-data-analysis 0.2.2 → 0.2.3

package/lib/compatibility.js

@@ -48,6 +48,7 @@ function parsePackageManifest(value) {
             contracts: Object.freeze({
                 runtimeInstallation: requiredLiteral(contracts.runtimeInstallation, 'dsh-data-analysis-runtime/v3', 'package compatibility contracts.runtimeInstallation'),
                 subprocessPolicy: requiredLiteral(contracts.subprocessPolicy, 'direct-argv-inherited-env-snapshot-overlay-v2', 'package compatibility contracts.subprocessPolicy'),
+                integration: requiredLiteral(contracts.integration, 'dsh-data-analysis-integration/v1', 'package compatibility contracts.integration'),
             }),
         }),
     });

package/lib/datasource/defaults.js

@@ -1,10 +1,13 @@
 import { z } from 'zod';
 import { CredentialServiceError } from "./service.js";
+import { marivoCredentialStorageRef } from "./shell-env.js";
 /** Validate against this Workspace's live Runtime; never include config values in errors. */
-export function withDatasourceDefaults(schema, configured) {
-    if (configured === undefined)
+export function withDatasourceDefaults(schema, configured, managed) {
+    if (configured === undefined && managed === undefined)
         return schema;
-    const parsed = z.record(z.string(), z.record(z.string(), z.json())).safeParse(configured);
+    const parsed = z
+        .record(z.string(), z.record(z.string(), z.json()))
+        .safeParse(configured === undefined ? {} : configured);
     if (!parsed.success)
         throw new CredentialServiceError('datasource-defaults-invalid');
     for (const [backend, values] of Object.entries(parsed.data)) {
@@ -21,5 +24,24 @@ export function withDatasourceDefaults(schema, configured) {
                 throw new CredentialServiceError('datasource-defaults-type-invalid');
         }
     }
-    return { ...schema, creationDefaults: parsed.data };
+    const combined = Object.fromEntries(Object.entries(parsed.data).map(([backend, values]) => [backend, { ...values }]));
+    if (managed !== undefined) {
+        const references = z.record(z.string(), z.record(z.string(), z.string())).safeParse(managed);
+        if (!references.success)
+            throw new CredentialServiceError('datasource-defaults-invalid');
+        for (const [backend, fields] of Object.entries(references.data)) {
+            const definition = schema.backends.find((item) => item.name === backend);
+            if (!definition)
+                throw new CredentialServiceError('datasource-defaults-backend-invalid');
+            for (const [name, reference] of Object.entries(fields)) {
+                if (!name.endsWith('_env') || !definition.fields.some((field) => field.name === name))
+                    throw new CredentialServiceError('datasource-defaults-field-invalid');
+                marivoCredentialStorageRef(reference);
+                if (Object.hasOwn(combined[backend] ?? {}, name))
+                    throw new CredentialServiceError('datasource-defaults-credential-forbidden');
+            }
+            combined[backend] = { ...combined[backend], ...fields };
+        }
+    }
+    return { ...schema, creationDefaults: combined };
 }

package/lib/datasource/rpc.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { registerPluginRpc } from "../rpc.js";
-import { withDatasourceDefaults } from "./defaults.js";
+import { withDatasourceDefaults, } from "./defaults.js";
 import { CREDENTIAL_CHANNEL, credentialError } from "./service.js";
 const text = z.string().min(1).max(256);
 const handle = { generation: z.string().uuid(), id: z.string().uuid(), scope: z.string().uuid() };
@@ -15,7 +15,7 @@ const mutation = z
     changes: z.record(text, z.string().min(1).max(65536)).optional(),
 })
     .strict();
-export function registerCredentialRpc(connection, service, workspace, datasourceDefaults) {
+export function registerCredentialRpc(connection, service, workspace, datasourceDefaults, managedCredentialDefaults) {
     const unregister = registerPluginRpc(connection, CREDENTIAL_CHANNEL, [
         'overview',
         'authoring',
@@ -53,7 +53,7 @@ export function registerCredentialRpc(connection, service, workspace, datasource
                     generation: service.generation,
                     ...(input.mode === 'edit'
                         ? schema
-                        : withDatasourceDefaults(schema, datasourceDefaults)),
+                        : withDatasourceDefaults(schema, datasourceDefaults, managedCredentialDefaults)),
                 };
             }
             else if (endpoint === 'configuration') {

package/lib/environment/runtime.js

@@ -527,6 +527,8 @@ export async function ensureSharedMarivoRuntime(config = {}, options = {}) {
     const existing = await validatedExisting(runtimeRoot, configuredPython, options.environment, timeoutMs, presentationKitWheel);
     if (existing !== undefined)
         return existing;
+    if (options.existingOnly)
+        throw new MarivoEnvironmentError('shared-runtime-installation-required', 'A valid shared Marivo Runtime installation is required');
     await mkdir(path.dirname(runtimeRoot), { recursive: true });
     const lockPath = `${runtimeRoot}.install-lock`;
     const release = await acquireLock(lockPath, timeoutMs, options.waitIntervalMs ?? 100);

package/lib/environment/workspace.js

@@ -31,9 +31,11 @@ export class MarivoWorkspaceEnvironmentManager {
     #disposed = false;
     #closing;
     runtime;
+    onBound;
     #bindings = new Map();
-    constructor(runtime) {
+    constructor(runtime, onBound) {
         this.runtime = runtime;
+        this.onBound = onBound;
     }
     resolve(projectRoot) {
         return this.#tasks.track(this.#resolve(projectRoot));
@@ -54,6 +56,16 @@ export class MarivoWorkspaceEnvironmentManager {
                     version: this.runtime.presentationKitVersion,
                     packagePath: this.runtime.presentationKitPackagePath,
                 },
+            })
+                .then(async (environment) => {
+                if (this.#disposed)
+                    throw new Error('Marivo Workspace manager disposed');
+                await this.onBound?.(environment);
+                return environment;
+            })
+                .catch((error) => {
+                this.#bindings.delete(canonicalRoot);
+                throw error;
             });
             this.#bindings.set(canonicalRoot, binding);
         }

package/lib/integration.js

@@ -0,0 +1,5 @@
+/** Public extension seam. The version denotes this shape, not a specific consumer. */
+export const INTEGRATION_CONTRACT_VERSION = 'dsh-data-analysis-integration/v1';
+export { withDatasourceDefaults } from "./datasource/defaults.js";
+export { applyWithIntegration } from "./plugin.js";
+export { registerPluginRpc } from "./rpc.js";

package/lib/plugin.js

@@ -70,6 +70,10 @@ function configuredProjectRoot(config, agent) {
 }
 /** Ensure the shared Runtime once, mount its skills, then bind each Workspace lazily. */
 export async function apply(ctx, config = {}) {
+    return applyWithIntegration(ctx, config);
+}
+/** Compose an extension at the public seam while retaining the ordinary plugin behavior. */
+export async function applyWithIntegration(ctx, config = {}, integration = {}) {
     const publishingConfig = resolvePublishingConfig(config.reportPublishing);
     const pythonOptions = currentPythonOptions(config);
     const pythonExecutable = config.pythonExecutable ?? process.env.DSH_DATA_ANALYSIS_PYTHON;
@@ -82,7 +86,7 @@ export async function apply(ctx, config = {}) {
         ...(config.installTimeoutMs === undefined ? {} : { installTimeoutMs: config.installTimeoutMs }),
     });
     const disposeRuntimeShellEnvironment = registerMarivoRuntimeShellEnvironment(ctx, runtime.pythonExecutable);
-    const manager = new MarivoWorkspaceEnvironmentManager(runtime);
+    const manager = new MarivoWorkspaceEnvironmentManager(runtime, integration.onWorkspaceBound);
     const bindings = new WeakMap();
     const resolveEnvironment = (agent) => {
         const root = configuredProjectRoot(config, agent);
@@ -93,7 +97,7 @@ export async function apply(ctx, config = {}) {
         bindings.set(agent, { root, environment });
         return environment;
     };
-    const credentialService = new MarivoCredentialService(ctx.credentials, config.credentialInteraction);
+    const credentialService = new MarivoCredentialService(integration.datasourceCredentials ?? ctx.credentials, config.credentialInteraction);
     const credentialNotifications = new CredentialChangesService(ctx, credentialService);
     let unregisterChanges;
     const disposeChanges = async () => {
@@ -188,7 +192,7 @@ export async function apply(ctx, config = {}) {
                     root)
                 throw new Error('Workspace changed');
             return new MarivoDatasourceBridge(environment);
-        }, config.datasourceDefaults);
+        }, config.datasourceDefaults, integration.managedCredentialDefaults);
         let lastDiagnostic = -Infinity;
         const usage = new SemanticReferenceUsage(ctx.storageDomain, Date.now, () => {
             if (Date.now() - lastDiagnostic >= 30_000) {

package/lib/types/client.d.ts

@@ -3,6 +3,7 @@ import { installRightTabs } from './client/right-tabs/install.tsx';
 export { marivoPresentationDeliveryDefinition, parsePresentationDurableContent, presentationDeliveryFromEvent, presentationsForNode, } from './client/presentation/delivery.ts';
 export { PresentationDeliveryModel } from './client/presentation/delivery-model.ts';
 export { HostPresentationReader } from './client/presentation/host-entry.tsx';
+export { createPluginRpc } from './client/rpc.ts';
 export declare const inject: string[];
 export declare function apply(ctx: Context, options?: {
     diagnostics?: boolean;

package/lib/types/compatibility.d.ts

@@ -12,6 +12,7 @@ export interface DshDataAnalysisCompatibility {
     readonly contracts: {
         readonly runtimeInstallation: 'dsh-data-analysis-runtime/v3';
         readonly subprocessPolicy: 'direct-argv-inherited-env-snapshot-overlay-v2';
+        readonly integration: 'dsh-data-analysis-integration/v1';
     };
 }
 /** The package semver and the compatibility contract shipped in this exact installation. */

package/lib/types/datasource/defaults.d.ts

@@ -1,7 +1,8 @@
 import type { DatasourceAuthoring } from './authoring.ts';
 export type DatasourceDefaults = Record<string, Record<string, unknown>>;
+export type ManagedCredentialDefaults = Record<string, Record<string, string>>;
 export type DatasourceAuthoringView = DatasourceAuthoring & {
     creationDefaults?: DatasourceDefaults;
 };
 /** Validate against this Workspace's live Runtime; never include config values in errors. */
-export declare function withDatasourceDefaults(schema: DatasourceAuthoring, configured: unknown): DatasourceAuthoringView;
+export declare function withDatasourceDefaults(schema: DatasourceAuthoring, configured: unknown, managed?: ManagedCredentialDefaults): DatasourceAuthoringView;

package/lib/types/datasource/rpc.d.ts

@@ -1,5 +1,5 @@
 import type { HostConnectionHandle } from '@deepseek-ai/dsh-client-connection';
 import type { MarivoDatasourceBridgePort } from './bridge.ts';
-import { type DatasourceDefaults } from './defaults.ts';
+import { type DatasourceDefaults, type ManagedCredentialDefaults } from './defaults.ts';
 import { type MarivoCredentialService } from './service.ts';
-export declare function registerCredentialRpc(connection: HostConnectionHandle, service: MarivoCredentialService, workspace: (id: string) => Promise<MarivoDatasourceBridgePort>, datasourceDefaults?: DatasourceDefaults): () => Promise<void>;
+export declare function registerCredentialRpc(connection: HostConnectionHandle, service: MarivoCredentialService, workspace: (id: string) => Promise<MarivoDatasourceBridgePort>, datasourceDefaults?: DatasourceDefaults, managedCredentialDefaults?: ManagedCredentialDefaults): () => Promise<void>;

package/lib/types/environment/errors.d.ts

@@ -1,4 +1,4 @@
-export type EnvironmentFailureCode = 'project-root-invalid' | 'python-path-relative' | 'python-unavailable' | 'shared-runtime-config-invalid' | 'shared-runtime-lock-timeout' | 'shared-runtime-install-failed' | 'shared-runtime-identity-mismatch' | 'shared-runtime-version-unsupported' | 'shared-runtime-pandas-unsupported' | 'shared-runtime-presentation-kit-unsupported' | 'shared-runtime-presentation-kit-wheel-invalid' | 'shared-runtime-presentation-kit-wheel-unavailable' | 'shared-runtime-package-unavailable' | 'shared-runtime-skills-invalid' | 'subprocess-start-failed' | 'subprocess-timeout' | 'subprocess-cancelled' | 'subprocess-output-limit' | 'subprocess-output-invalid' | 'subprocess-failed' | 'datasource-credential-ref-invalid' | 'datasource-credential-resolve-failed' | 'shell-credential-lease-invalid' | 'shell-credential-lease-expired' | 'shell-credential-lease-exhausted' | 'shell-credential-lease-scope-mismatch' | 'shell-credential-lease-resolve-failed' | 'shell-credential-injection-unsupported' | 'doctor-json-invalid' | 'doctor-admission-failed' | 'binding-identity-mismatch' | 'binding-failed';
+export type EnvironmentFailureCode = 'project-root-invalid' | 'python-path-relative' | 'python-unavailable' | 'shared-runtime-config-invalid' | 'shared-runtime-installation-required' | 'shared-runtime-lock-timeout' | 'shared-runtime-install-failed' | 'shared-runtime-identity-mismatch' | 'shared-runtime-version-unsupported' | 'shared-runtime-pandas-unsupported' | 'shared-runtime-presentation-kit-unsupported' | 'shared-runtime-presentation-kit-wheel-invalid' | 'shared-runtime-presentation-kit-wheel-unavailable' | 'shared-runtime-package-unavailable' | 'shared-runtime-skills-invalid' | 'subprocess-start-failed' | 'subprocess-timeout' | 'subprocess-cancelled' | 'subprocess-output-limit' | 'subprocess-output-invalid' | 'subprocess-failed' | 'datasource-credential-ref-invalid' | 'datasource-credential-resolve-failed' | 'shell-credential-lease-invalid' | 'shell-credential-lease-expired' | 'shell-credential-lease-exhausted' | 'shell-credential-lease-scope-mismatch' | 'shell-credential-lease-resolve-failed' | 'shell-credential-injection-unsupported' | 'doctor-json-invalid' | 'doctor-admission-failed' | 'binding-identity-mismatch' | 'binding-failed';
 /** Stable failure envelope for config, subprocess, doctor, and identity errors. */
 export declare class MarivoEnvironmentError extends Error {
     readonly code: EnvironmentFailureCode;

package/lib/types/environment/runtime.d.ts

@@ -7,6 +7,8 @@ export declare const PRESENTATION_KIT_PANDAS_RANGE = ">=2.2.0,<3.0.0";
 export declare const PRESENTATION_KIT_WHEEL_FILENAME = "dsh_data_analysis_presentation_kit-1.1.0-py3-none-any.whl";
 export declare const DEFAULT_SHARED_RUNTIME_INSTALL_TIMEOUT_MS = 600000;
 interface RuntimeInstallOptions {
+    /** Validate an existing installation without creating directories or acquiring an install lock. */
+    existingOnly?: boolean;
     environment?: NodeJS.ProcessEnv;
     waitIntervalMs?: number;
     /** Test/build seam; production always resolves the wheel distributed beside the plugin. */

package/lib/types/environment/workspace.d.ts

@@ -4,7 +4,8 @@ import type { SharedMarivoRuntime } from './types.ts';
 export declare class MarivoWorkspaceEnvironmentManager {
     #private;
     readonly runtime: SharedMarivoRuntime;
-    constructor(runtime: SharedMarivoRuntime);
+    readonly onBound?: (environment: MarivoEnvironment) => Promise<void>;
+    constructor(runtime: SharedMarivoRuntime, onBound?: (environment: MarivoEnvironment) => Promise<void>);
     resolve(projectRoot: string): Promise<MarivoEnvironment>;
     close(): Promise<void>;
     dispose(): void;

package/lib/types/integration.d.ts

@@ -0,0 +1,16 @@
+import type { ManagedCredentialDefaults } from './datasource/defaults.ts';
+import type { CredentialStore } from './datasource/service.ts';
+import type { MarivoEnvironment } from './environment/index.ts';
+/** Public extension seam. The version denotes this shape, not a specific consumer. */
+export declare const INTEGRATION_CONTRACT_VERSION: "dsh-data-analysis-integration/v1";
+export interface MarivoIntegrationV1 {
+    /** Runs once after a Workspace binds, before its environment is returned. */
+    readonly onWorkspaceBound?: (environment: MarivoEnvironment) => Promise<void>;
+    /** Harness-managed store used only by datasource operations. */
+    readonly datasourceCredentials?: CredentialStore;
+    /** Credential reference names, validated against the live Workspace Runtime schema. */
+    readonly managedCredentialDefaults?: ManagedCredentialDefaults;
+}
+export { withDatasourceDefaults } from './datasource/defaults.ts';
+export { applyWithIntegration } from './plugin.ts';
+export { registerPluginRpc } from './rpc.ts';

package/lib/types/plugin.d.ts

@@ -5,6 +5,7 @@ export { resolvePresentationWorkspace } from './workspace-identity.ts';
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
 import type { DatasourceDefaults } from './datasource/defaults.ts';
+import type { MarivoIntegrationV1 } from './integration.ts';
 export { MARIVO_DATASOURCE_CREDENTIAL_PROMPT } from './disclosure/execution-guidance.ts';
 /** Cordis plugin name used by loader diagnostics and lifecycle logs. */
 export declare const name = "dsh-data-analysis";
@@ -51,3 +52,5 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
 }>>, "plain">;
 /** Ensure the shared Runtime once, mount its skills, then bind each Workspace lazily. */
 export declare function apply(ctx: Context, config?: Config): Promise<() => Promise<void>>;
+/** Compose an extension at the public seam while retaining the ordinary plugin behavior. */
+export declare function applyWithIntegration(ctx: Context, config?: Config, integration?: MarivoIntegrationV1): Promise<() => Promise<void>>;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@chengxianglibra/dsh-data-analysis",
   "description": "Marivo runtime, live Help, secure datasource execution and presentation delivery for DeepSeek Harness",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/chengxianglibra/dsh-data-analysis.git",
@@ -31,6 +31,14 @@
       "types": "./lib/types/client.d.ts",
       "default": "./lib/client.js"
     },
+    "./client-composition": {
+      "types": "./lib/types/client.d.ts",
+      "default": "./lib/client-composition.js"
+    },
+    "./integration": {
+      "types": "./lib/types/integration.d.ts",
+      "default": "./lib/integration.js"
+    },
     "./environment": {
       "types": "./lib/types/environment/index.d.ts",
       "default": "./lib/environment/index.js"
@@ -82,7 +90,8 @@
     },
     "contracts": {
       "runtimeInstallation": "dsh-data-analysis-runtime/v3",
-      "subprocessPolicy": "direct-argv-inherited-env-snapshot-overlay-v2"
+      "subprocessPolicy": "direct-argv-inherited-env-snapshot-overlay-v2",
+      "integration": "dsh-data-analysis-integration/v1"
     }
   },
   "dsh": {