@xpert-ai/plugin-live-dashboard 0.1.4 → 0.2.0

package/.xpertai-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "@xpert-ai/plugin-live-dashboard",
-  "version": "0.1.4",
+  "version": "0.2.0",
   "level": "system",
   "artifactNamespace": "live_dashboard",
   "sandboxActions": "./dist/sandbox-actions/action.json",

package/README.md

@@ -31,7 +31,7 @@ The Workbench supplies its selected Artifact/version through the platform contex
 update preserves identity and omitted fields, requires fresh preview receipts for replacement bindings, and uses the existing validation/CAS path.
 Successful update receipts open the saved working draft; only human publication creates a formal version. See [continuous editing](docs/editing.mdx).
 
-Tools are `dashboard_list_sources`, `dashboard_discover`, `dashboard_preview`, `dashboard_preview_binding`, `dashboard_create`, `dashboard_open`, `dashboard_update` and `dashboard_create_html`. File authoring is supplied by the platform SandboxFile middleware. The canonical preview tool accepts complete `bindingJson` returned by an adapter registration tool. Both preview tools use the same discovery and receipt checks. The middleware adds business-semantic guidance while preserving the host system message. It requires discovery and a successful preview of the exact binding/defaults before creation via run-local `previewId` receipts; save revalidates current source access. Evidence is local to the run and actor, and repeated creation of the same manifest rechecks authorization before reusing its Artifact.
+Tools are `dashboard_list_sources`, `dashboard_discover`, `dashboard_preview`, `dashboard_preview_binding`, `dashboard_create`, `dashboard_open`, `dashboard_update` and `dashboard_create_html`. File authoring is supplied by the platform SandboxFile middleware. The canonical preview tool accepts complete `bindingJson` returned by an adapter registration tool. Both preview tools automatically discover the query contract with an empty request when it is absent in this run. Contracts are cached by exact source (including version) and provider; concurrent previews share discovery, and discovery failures propagate without executing the query and can be retried. Explicit discovery remains available for business metadata inspection. Source selection, payload validation and runtime authorization still apply. The middleware adds business-semantic guidance while preserving the host system message. Creation requires a successful preview of the exact binding/defaults via run-local `previewId` receipts; save revalidates current source access. Evidence is local to the run and actor, and repeated creation of the same manifest rechecks authorization before reusing its Artifact.
 
 Specialized Assistants may configure `allowedFinalProviders` on the middleware, for example `["workspace_script.query"]`. Upstream discovery and preview still work with other providers, but Agent save rejects final bindings outside this list. Omit it for the existing unrestricted provider workflow. This is an Agent workflow policy, not a substitute for the server's source/Artifact authorization.
 
@@ -39,7 +39,7 @@ For a dedicated Dashboard Assistant, mark its connected `LiveDashboard` middlewa
 
 Only the LLM boundary uses `requestJson` / `payloadJson` strings, because recursive JSON unions are unreliable in model function schemas. The plugin parses these into the unchanged canonical JSON protocol before calling the platform. Protocol version and operation come from the discovered provider contract; parameter name also supplies the Agent-created control ID. Saved manifests retain the full generic Binding protocol. Preview uses Binding parameter defaults, avoiding a second control mapping for the model to repeat. Provider syntax is learned from discovery, not embedded in platform prompts.
 
-The model gets at most 20 preview rows/32 KB, with original completeness and explicit omitted-row counts. It has 24 model tool rounds; after that it must report saved receipts or a blocker. Authored definitions, units, date range and aggregation grain still require business verification: structural validation alone does not prove metric correctness.
+The model gets at most 20 preview rows/32 KB, with original completeness and explicit omitted-row counts. Failed preview/filter-test inputs execute at most twice per run; repeated identical failures are blocked before querying. Six consecutive preview failures stop tool use and request a truthful blocker summary; a model that still emits tool calls receives a terminal diagnostic instead. Schema failures count too. Successful previews reset the consecutive-failure count, and corrected inputs can be tried before the limit. The model also has 24 model tool rounds; after that it must report saved receipts or a blocker. Authored definitions, units, date range and aggregation grain still require business verification: structural validation alone does not prove metric correctness.
 
 Categorical charts must encode every Dataset grain dimension in `x`/`color`. The renderer does not aggregate: totals need a separate previewed binding. Unsupported business metrics require clarification, not a proxy dashboard without agreement.
 
@@ -63,7 +63,7 @@ See [HTML mode and acceptance](docs/html-mode.md). Agent tools write a complete
 
 The platform browser entry `@xpert-ai/plugin-sdk/artifact-document` owns the sandbox, CSP, MessageChannel, request validation and latest-response policy. The plugin owns lifecycle and supplies a narrow callback to `query-binding`. Its server loads the exact saved Artifact version, finds the declared Binding, validates controls and rechecks source access. The endpoint rejects full Binding, Provider, SQL/payload and alternate source fields.
 
-Pages call `window.xpertLiveArtifact.ready()`, `subscribe(bindingId, render)`, `query(bindingId, controls)` and `refresh(bindingId)`. Register subscriptions before the first query so the toolbar can refresh without resetting the document. Use inline DOM/SVG/Canvas; network/CDN imports and eval are unavailable. Script processing remains in the separate Workspace Script provider.
+Pages call `window.xpertLiveArtifact.ready()`, `subscribe(bindingId, render)`, `query(bindingId, controls)` and `refresh(bindingId)`. Register subscriptions before the first query so the toolbar can refresh without resetting the document. Use inline DOM/SVG/Canvas or online scripts/styles/fonts from the HTTPS origins returned by `dashboard_libraries.online`. Tailwind CDN, jsDelivr, cdnjs, unpkg and Google Fonts are supported according to their resource-type allowlist. Preflight and the displayed page use the same policy; failed loads prevent saving. Pin online versions where possible. Unlike packaged libraries, online bytes are not part of the immutable Artifact snapshot. Direct data requests, external images, eval, workers and frames remain unavailable. Script processing remains in the separate Workspace Script provider.
 
 HTML is capped at 300 KB; the whole saved definition remains capped at 600 KB. HTML pages own their chart layout, so their charts/tables arrays are empty. The standard renderer remains an independent option. Sharing, data permissions and source limits are unchanged.
 
@@ -75,7 +75,7 @@ The renderer runs in a script-only sandbox with no-network CSP. A small in-memor
 
 ## Build and validation
 
-Use the xpertai workspace's declared Corepack/pnpm. Development dependencies pin published SDK/contracts 3.26.1 and the Data Analytics renderer 0.1.35; no local platform or community links are required.
+Use the xpertai workspace's declared Corepack/pnpm. Development dependencies pin published SDK/contracts 3.27.0 and the Data Analytics renderer 0.1.35; no local platform or community links are required. SDK 3.27.0 includes the host-owned online resource policy, so no SDK patch is required. Rebuild both the viewer and HTML preflight assets after changing the SDK; `verify:dist` checks their source fingerprints.
 
 ```sh
 corepack pnpm install --frozen-lockfile

package/dist/lib/content-capability.d.ts

@@ -0,0 +1,22 @@
+import { ModelFeature, type TXpertTeamDraft } from '@xpert-ai/contracts';
+import { type IAssistantCapabilityProvider, type AssistantCapabilityApplyContext } from '@xpert-ai/plugin-sdk';
+/** Optional tool composition; installing a View never silently enables these tools. */
+export declare class DashboardCapability implements IAssistantCapabilityProvider {
+    readonly key = "live-dashboard";
+    readonly availableForBlankAssistant = true;
+    readonly supportsQuickCreation = true;
+    readonly requiredModelFeatures: ModelFeature[];
+    readonly label: {
+        en_US: string;
+        zh_Hans: string;
+    };
+    readonly description: {
+        en_US: string;
+        zh_Hans: string;
+    };
+    isEnabled(draft: TXpertTeamDraft): boolean;
+    check(): Promise<{
+        available: boolean;
+    }>;
+    apply({ draft }: AssistantCapabilityApplyContext): Promise<void>;
+}

package/dist/lib/content-capability.js

@@ -0,0 +1,33 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DashboardCapability = void 0;
+const common_1 = require("@nestjs/common");
+const contracts_1 = require("@xpert-ai/contracts");
+const plugin_sdk_1 = require("@xpert-ai/plugin-sdk");
+/** Optional tool composition; installing a View never silently enables these tools. */
+let DashboardCapability = class DashboardCapability {
+    constructor() {
+        this.key = 'live-dashboard';
+        this.availableForBlankAssistant = true;
+        this.supportsQuickCreation = true;
+        this.requiredModelFeatures = [contracts_1.ModelFeature.TOOL_CALL];
+        this.label = { en_US: 'Live dashboards', zh_Hans: '实时看板' };
+        this.description = { en_US: 'Create and maintain live dashboards with this Assistant in a Project.', zh_Hans: '为 Assistant 增加实时看板的创建与维护工具，沿用项目权限。' };
+    }
+    isEnabled(draft) { return (0, plugin_sdk_1.hasAssistantMiddleware)(draft, 'LiveDashboard'); }
+    async check() { return { available: true }; }
+    async apply({ draft }) {
+        (0, plugin_sdk_1.applyAssistantMiddleware)(draft, { provider: 'LiveDashboard', key: 'Capability_DashboardCapability', title: 'Live dashboards', instructions: 'Maintain live dashboard definitions in the current Project using Live Dashboard tools and registered Analytics providers. Discover and validate current data bindings before saving. Read the current draft revision and handle conflicts without overwriting another editor. Query with the current actor permissions; never copy credentials or query rows into the shared definition. Publishing a definition is separate from saving and refreshing data.' });
+    }
+};
+exports.DashboardCapability = DashboardCapability;
+exports.DashboardCapability = DashboardCapability = __decorate([
+    (0, common_1.Injectable)(),
+    (0, plugin_sdk_1.AssistantCapabilityProvider)('live-dashboard')
+], DashboardCapability);

package/dist/lib/content.provider.d.ts

@@ -0,0 +1,23 @@
+import type { ResourceContentEditorRegistration } from '@xpert-ai/contracts';
+import { type RuntimeCapabilityRegistry, type ContentCatalogProvider, type ContentResourceRequest, type IContentResourceProvider } from '@xpert-ai/plugin-sdk';
+import { DashboardService } from './dashboard.service';
+export declare const DASHBOARD_CONTENT_PROVIDER = "live-dashboard.content";
+export declare class DashboardContentEditor {
+    readonly descriptor: ResourceContentEditorRegistration;
+}
+export declare class DashboardContentProvider implements IContentResourceProvider {
+    private readonly service;
+    private readonly runtime;
+    readonly title = "Live Dashboard";
+    constructor(service: DashboardService, runtime: RuntimeCapabilityRegistry);
+    readonly catalog: ContentCatalogProvider;
+    authorize(input: ContentResourceRequest): Promise<{
+        providerKey: string;
+        resourceId: string;
+        title: string;
+        role: "owner" | "manager" | "editor" | "member";
+        canWrite: boolean;
+        canManage: boolean;
+    }>;
+    private describe;
+}

package/dist/lib/content.provider.js

@@ -0,0 +1,163 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DashboardContentProvider = exports.DashboardContentEditor = exports.DASHBOARD_CONTENT_PROVIDER = void 0;
+const common_1 = require("@nestjs/common");
+const plugin_sdk_1 = require("@xpert-ai/plugin-sdk");
+const dashboard_service_1 = require("./dashboard.service");
+const dashboard_search_1 = require("./dashboard-search");
+exports.DASHBOARD_CONTENT_PROVIDER = 'live-dashboard.content';
+const MODEL = { typeId: 'xpert.live-dashboard', modelId: 'live-dashboard.manifest', schemaVersion: '1', editProtocol: { id: 'artifact-draft.cas', version: '1' } };
+const EDITOR = 'live-dashboard.editor';
+const context = (scope) => ({ ...scope.actor, hostType: 'project', hostId: scope.projectId, slots: [] });
+let DashboardContentEditor = class DashboardContentEditor {
+    constructor() {
+        this.descriptor = { kind: 'resource', protocolVersion: 2, key: EDITOR, title: 'Live Dashboard',
+            view: { providerKey: 'live-dashboard', viewKey: 'live-dashboard', entry: 'live-dashboard' }, supports: [{ ...MODEL, access: ['view', 'edit'] }] };
+    }
+};
+exports.DashboardContentEditor = DashboardContentEditor;
+exports.DashboardContentEditor = DashboardContentEditor = __decorate([
+    (0, common_1.Injectable)(),
+    (0, plugin_sdk_1.ContentEditorProvider)(EDITOR)
+], DashboardContentEditor);
+let DashboardContentProvider = class DashboardContentProvider {
+    constructor(service, runtime) {
+        this.service = service;
+        this.runtime = runtime;
+        this.title = 'Live Dashboard';
+        this.catalog = {
+            types: [{ ...MODEL, title: { en_US: 'Live dashboards', zh_Hans: '实时看板' }, implementationKey: 'live-dashboard',
+                    implementationTitle: { en_US: 'Live Dashboard', zh_Hans: '实时看板' }, defaultEditorKey: EDITOR }],
+            discover: async (scope) => {
+                await this.service.authorizeProject(context(scope));
+                const page = Number(scope.cursor ?? 1);
+                if (!Number.isSafeInteger(page) || page < 1)
+                    throw new common_1.BadRequestException('DASHBOARD_INVALID_CURSOR');
+                const result = await this.runtime.require(plugin_sdk_1.ArtifactsRuntimeCapability).listArtifacts({ pluginName: dashboard_service_1.PLUGIN_NAME,
+                    resourceType: 'live-dashboard', resourceIdPrefix: `project/${scope.projectId}/`, page, pageSize: 100, status: 'all' });
+                return { resourceIds: result.items.filter(item => !item.userId && item.projectId === scope.projectId && item.status !== 'deleted').map(item => item.id),
+                    ...(result.items.length === 100 ? { nextCursor: String(page + 1) } : {}) };
+            },
+            describe: input => this.describe(input),
+            extract: async (input) => {
+                const saved = await this.service.open(context(input), input.sourceResourceId);
+                return (0, dashboard_search_1.dashboardSearchProjection)(saved.manifest, String(saved.draftRevision ?? 0));
+            },
+            create: async (input) => {
+                if (input.templateId)
+                    throw new common_1.BadRequestException('DASHBOARD_TEMPLATE_UNAVAILABLE');
+                const ctx = context(input);
+                await this.service.authorizeProject(ctx, 'write');
+                const source = { pluginName: dashboard_service_1.PLUGIN_NAME, resourceType: 'live-dashboard', resourceId: `project/${input.projectId}/${input.requestId}` };
+                const existing = await this.runtime.require(plugin_sdk_1.ArtifactsRuntimeCapability).findArtifactBySource(source);
+                if (existing && await this.runtime.require(plugin_sdk_1.ArtifactDraftsRuntimeCapability).get(existing.id))
+                    return { providerKey: exports.DASHBOARD_CONTENT_PROVIDER, resourceId: existing.id };
+                try {
+                    const created = await this.service.save(ctx, { schema: 'xpert.live-dashboard', id: input.requestId, title: input.title,
+                        bindings: [], controls: [], charts: [], tables: [] }, null, 0);
+                    return { providerKey: exports.DASHBOARD_CONTENT_PROVIDER, resourceId: created.artifactId };
+                }
+                catch (error) {
+                    // Another request with this create-only identity may have saved the first
+                    // draft. Reuse it; never retry a create by overwriting the current draft.
+                    if (!(error instanceof common_1.ConflictException))
+                        throw error;
+                    const winner = await this.runtime.require(plugin_sdk_1.ArtifactsRuntimeCapability).findArtifactBySource(source);
+                    if (!winner || !await this.runtime.require(plugin_sdk_1.ArtifactDraftsRuntimeCapability).get(winner.id))
+                        throw error;
+                    await this.service.open(ctx, winner.id);
+                    return { providerKey: exports.DASHBOARD_CONTENT_PROVIDER, resourceId: winner.id };
+                }
+            },
+            mutate: async (input) => {
+                const ctx = context(input), drafts = this.runtime.require(plugin_sdk_1.ArtifactDraftsRuntimeCapability);
+                if (input.change.action === 'trash' || input.change.action === 'restore') {
+                    await this.service.authorizeProject(ctx, 'manage');
+                    await drafts.setRecycled({ artifactId: input.sourceResourceId, expectedRevision: Number(input.expectedRevision), recycled: input.change.action === 'trash' });
+                }
+                else {
+                    const saved = await this.service.open(ctx, input.sourceResourceId);
+                    if (String(saved.draftRevision ?? 0) !== input.expectedRevision)
+                        throw new common_1.ConflictException('DASHBOARD_DRAFT_CONFLICT');
+                    if (input.change.action === 'duplicate') {
+                        await this.service.authorizeProject(ctx, 'write');
+                        const artifacts = this.runtime.require(plugin_sdk_1.ArtifactsRuntimeCapability);
+                        const source = { pluginName: dashboard_service_1.PLUGIN_NAME, resourceType: 'live-dashboard', resourceId: `project/${input.projectId}/${input.change.requestId}` };
+                        const existing = await artifacts.findArtifactBySource(source);
+                        if (existing && await drafts.get(existing.id))
+                            return { providerKey: exports.DASHBOARD_CONTENT_PROVIDER, resourceId: existing.id };
+                        try {
+                            // Only the definition is copied. Data is queried again as the acting user;
+                            // published versions, share tokens and query results are never cloned.
+                            const copy = await this.service.save(ctx, { ...saved.manifest, id: input.change.requestId, title: input.change.title }, null, 0);
+                            return { providerKey: exports.DASHBOARD_CONTENT_PROVIDER, resourceId: copy.artifactId };
+                        }
+                        catch (error) {
+                            if (!(error instanceof common_1.ConflictException))
+                                throw error;
+                            const winner = await artifacts.findArtifactBySource(source);
+                            if (!winner || !await drafts.get(winner.id))
+                                throw error;
+                            return { providerKey: exports.DASHBOARD_CONTENT_PROVIDER, resourceId: winner.id };
+                        }
+                    }
+                    if (input.change.action !== 'rename')
+                        throw new common_1.BadRequestException('DASHBOARD_ACTION_UNAVAILABLE');
+                    await this.service.update(ctx, input.sourceResourceId, Number(input.expectedRevision), { title: input.change.title }, saved.baseVersionId ?? saved.versionId ?? null);
+                }
+                return { providerKey: exports.DASHBOARD_CONTENT_PROVIDER, resourceId: input.sourceResourceId };
+            }
+        };
+    }
+    async authorize(input) {
+        const artifact = await this.runtime.require(plugin_sdk_1.ArtifactsRuntimeCapability).getArtifact(input.resourceId);
+        if (!artifact.projectId || artifact.userId || artifact.pluginName !== dashboard_service_1.PLUGIN_NAME || artifact.resourceType !== 'live-dashboard')
+            throw new common_1.ForbiddenException('DASHBOARD_ACCESS_DENIED');
+        const ctx = context({ actor: input.actor, projectId: artifact.projectId });
+        await this.service.authorizeProject(ctx, input.operation === 'read' ? 'read' : input.operation === 'manage' ? 'manage' : 'write');
+        const access = (await this.runtime.require(plugin_sdk_1.ProjectAccessRuntimeCapability).listReadable({ actor: input.actor, projectIds: [artifact.projectId] }))[0];
+        if (!access)
+            throw new common_1.ForbiddenException('DASHBOARD_ACCESS_DENIED');
+        return { providerKey: exports.DASHBOARD_CONTENT_PROVIDER, resourceId: input.resourceId, title: artifact.title ?? '', role: access.role,
+            canWrite: !access.archived && ['owner', 'manager', 'editor'].includes(access.role), canManage: access.canManage };
+    }
+    async describe(input) {
+        await this.service.authorizeProject(context(input));
+        const access = (await this.runtime.require(plugin_sdk_1.ProjectAccessRuntimeCapability).listReadable({ actor: input.actor, projectIds: [input.projectId] }))[0];
+        if (!access)
+            throw new common_1.ForbiddenException('DASHBOARD_ACCESS_DENIED');
+        const artifact = await this.runtime.require(plugin_sdk_1.ArtifactsRuntimeCapability).getArtifact(input.sourceResourceId);
+        if (artifact.projectId !== input.projectId || artifact.status === 'deleted')
+            throw new common_1.ForbiddenException('DASHBOARD_ACCESS_DENIED');
+        const draft = await this.runtime.require(plugin_sdk_1.ArtifactDraftsRuntimeCapability).get(input.sourceResourceId, { includeArchived: true });
+        if (!draft)
+            throw new common_1.BadRequestException('DASHBOARD_VERSION_UNAVAILABLE');
+        const deleted = artifact.status === 'archived';
+        const saved = !deleted ? await this.service.open(context(input), input.sourceResourceId) : null;
+        return { ...MODEL, offlineAccess: 'project', projectId: input.projectId, title: draft.title ?? artifact.title ?? '', revision: String(draft.revision),
+            updatedAt: new Date(draft.updatedAt ?? artifact.updatedAt ?? 0).toISOString(), deleted, defaultEditorKey: EDITOR,
+            allowedActions: [...(!deleted ? ['rename', 'duplicate'] : []), ...(access.canManage ? [deleted ? 'restore' : 'trash'] : [])],
+            ...(saved ? { preview: { kind: 'outline', revision: String(draft.revision), lines: [saved.manifest.title, ...saved.manifest.charts.map(chart => chart.title), ...saved.manifest.tables.map(table => table.title)].slice(0, 6).map(line => line.slice(0, 160)) } } : {}),
+            sourceSync: { status: 'synced', revision: String(draft.revision) },
+            source: draft.workspaceFileRef?.workspacePath ? { kind: 'file', path: draft.workspaceFileRef.workspacePath } : { kind: 'managed' } };
+    }
+};
+exports.DashboardContentProvider = DashboardContentProvider;
+exports.DashboardContentProvider = DashboardContentProvider = __decorate([
+    (0, common_1.Injectable)(),
+    (0, plugin_sdk_1.ContentResourceProvider)(exports.DASHBOARD_CONTENT_PROVIDER),
+    __param(1, (0, common_1.Inject)(plugin_sdk_1.XPERT_RUNTIME_CAPABILITIES_TOKEN)),
+    __metadata("design:paramtypes", [dashboard_service_1.DashboardService, Object])
+], DashboardContentProvider);

package/dist/lib/dashboard-navigation.d.ts

@@ -29,26 +29,46 @@ export declare function dashboardNavigationTarget(context: XpertResolvedViewHost
 export declare const dashboardNavigationSchema: z.ZodEffects<z.ZodObject<{
     selectionId: z.ZodOptional<z.ZodString>;
     parameters: z.ZodOptional<z.ZodObject<{
+        contentProvider: z.ZodOptional<z.ZodString>;
+        contentId: z.ZodOptional<z.ZodString>;
+        contentTitle: z.ZodOptional<z.ZodString>;
+        contentEditor: z.ZodOptional<z.ZodString>;
         artifactId: z.ZodOptional<z.ZodString>;
         versionId: z.ZodOptional<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
         artifactId?: string | undefined;
         versionId?: string | undefined;
+        contentProvider?: string | undefined;
+        contentId?: string | undefined;
+        contentTitle?: string | undefined;
+        contentEditor?: string | undefined;
     }, {
         artifactId?: string | undefined;
         versionId?: string | undefined;
+        contentProvider?: string | undefined;
+        contentId?: string | undefined;
+        contentTitle?: string | undefined;
+        contentEditor?: string | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
     selectionId?: string | undefined;
     parameters?: {
         artifactId?: string | undefined;
         versionId?: string | undefined;
+        contentProvider?: string | undefined;
+        contentId?: string | undefined;
+        contentTitle?: string | undefined;
+        contentEditor?: string | undefined;
     } | undefined;
 }, {
     selectionId?: string | undefined;
     parameters?: {
         artifactId?: string | undefined;
         versionId?: string | undefined;
+        contentProvider?: string | undefined;
+        contentId?: string | undefined;
+        contentTitle?: string | undefined;
+        contentEditor?: string | undefined;
     } | undefined;
 }>, {
     artifactId: string | undefined;
@@ -58,6 +78,10 @@ export declare const dashboardNavigationSchema: z.ZodEffects<z.ZodObject<{
     parameters?: {
         artifactId?: string | undefined;
         versionId?: string | undefined;
+        contentProvider?: string | undefined;
+        contentId?: string | undefined;
+        contentTitle?: string | undefined;
+        contentEditor?: string | undefined;
     } | undefined;
 }>;
 export type DashboardNavigation = z.infer<typeof dashboardNavigationSchema>;

package/dist/lib/dashboard-navigation.js

@@ -20,7 +20,7 @@ function dashboardNavigationTarget(context) {
 }
 exports.dashboardNavigationSchema = v3_1.z.object({
     selectionId: v3_1.z.string().uuid().optional(),
-    parameters: v3_1.z.object({ artifactId: v3_1.z.string().uuid().optional(), versionId: v3_1.z.string().uuid().optional() }).strict().optional()
+    parameters: v3_1.z.object({ contentProvider: v3_1.z.string().optional(), contentId: v3_1.z.string().uuid().optional(), contentTitle: v3_1.z.string().optional(), contentEditor: v3_1.z.string().optional(), artifactId: v3_1.z.string().uuid().optional(), versionId: v3_1.z.string().uuid().optional() }).strict().optional()
 }).transform((query, ctx) => {
     const artifactId = query.selectionId ?? query.parameters?.artifactId;
     const versionId = query.parameters?.versionId;

package/dist/lib/dashboard-queries.d.ts

@@ -6,3 +6,14 @@ export declare function validateControls(manifest: DashboardManifest, input: Rec
 };
 export declare function queryDashboardBinding(runtime: RuntimeCapabilityRegistry, actor: DataSourceActor, manifest: DashboardManifest, bindingId: string, input: Record<string, AnalyticsValue>): Promise<AnalyticalDataset>;
 export declare function queryDashboard(runtime: RuntimeCapabilityRegistry, actor: DataSourceActor, manifest: DashboardManifest, input: Record<string, AnalyticsValue>): Promise<AnalyticalDataset[]>;
+/** Read-only rendering can show independent successful bindings. Saving/publishing still
+ * uses queryDashboard and requires every binding to validate. Never return native error
+ * details, which may contain private source configuration or query text. */
+export declare function queryDashboardPartial(runtime: RuntimeCapabilityRegistry, actor: DataSourceActor, manifest: DashboardManifest, input: Record<string, AnalyticsValue>): Promise<{
+    datasets: AnalyticalDataset[];
+    failures: {
+        bindingId: string;
+        datasetId: string;
+        reason: "unavailable";
+    }[];
+}>;

package/dist/lib/dashboard-queries.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateControls = validateControls;
 exports.queryDashboardBinding = queryDashboardBinding;
 exports.queryDashboard = queryDashboard;
+exports.queryDashboardPartial = queryDashboardPartial;
 const common_1 = require("@nestjs/common");
 const plugin_sdk_1 = require("@xpert-ai/plugin-sdk");
 function validateControls(manifest, input) {
@@ -37,3 +38,22 @@ async function queryDashboard(runtime, actor, manifest, input) {
         throw new common_1.BadRequestException('DASHBOARD_RESULT_TOO_LARGE');
     return datasets;
 }
+/** Read-only rendering can show independent successful bindings. Saving/publishing still
+ * uses queryDashboard and requires every binding to validate. Never return native error
+ * details, which may contain private source configuration or query text. */
+async function queryDashboardPartial(runtime, actor, manifest, input) {
+    validateControls(manifest, input);
+    const datasets = [];
+    const failures = [];
+    for (const binding of manifest.bindings) {
+        try {
+            datasets.push(await queryDashboardBinding(runtime, actor, manifest, binding.id, input));
+        }
+        catch {
+            failures.push({ bindingId: binding.id, datasetId: binding.output.datasetId, reason: 'unavailable' });
+        }
+    }
+    if (Buffer.byteLength(JSON.stringify(datasets)) > 3_000_000)
+        throw new common_1.BadRequestException('DASHBOARD_RESULT_TOO_LARGE');
+    return { datasets, failures };
+}

package/dist/lib/dashboard-search.d.ts

@@ -0,0 +1,5 @@
+import type { ContentSearchProjection } from '@xpert-ai/contracts';
+import type { DashboardManifest } from './dashboard.schema';
+/** Explicit allowlist: no Binding source, parameter values, HTML/script, credentials
+ * or queried rows cross the shared knowledge boundary. Data access stays viewer-specific. */
+export declare function dashboardSearchProjection(manifest: DashboardManifest, revision: string): ContentSearchProjection;

package/dist/lib/dashboard-search.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dashboardSearchProjection = dashboardSearchProjection;
+/** Explicit allowlist: no Binding source, parameter values, HTML/script, credentials
+ * or queried rows cross the shared knowledge boundary. Data access stays viewer-specific. */
+function dashboardSearchProjection(manifest, revision) {
+    return { revision, sections: [
+            { anchor: { kind: 'document', id: manifest.id }, text: manifest.title },
+            ...[...manifest.charts, ...manifest.tables].map(view => ({ anchor: { kind: 'widget', id: view.id }, text: view.title })),
+            ...manifest.controls.map(control => ({ anchor: { kind: 'control', id: control.controlId }, text: control.label }))
+        ] };
+}

package/dist/lib/dashboard.schema.js

@@ -7,7 +7,7 @@ const artifact_document_1 = require("@xpert-ai/plugin-sdk/artifact-document");
 const id = v3_1.z.string().regex(/^[A-Za-z][A-Za-z0-9_.-]{0,79}$/);
 exports.dashboardSchema = v3_1.z.object({
     schema: v3_1.z.literal('xpert.live-dashboard'), id: v3_1.z.string().uuid(), title: v3_1.z.string().min(1).max(160),
-    bindings: v3_1.z.array(analytics_1.analyticsBindingSchema).min(1).max(8),
+    bindings: v3_1.z.array(analytics_1.analyticsBindingSchema).max(8),
     presentation: v3_1.z.object({ type: v3_1.z.literal('html'), html: artifact_document_1.artifactDocumentHtml, dependencies: artifact_document_1.artifactDocumentDependencyLocks.optional() }).strict().optional(),
     controls: v3_1.z.array(v3_1.z.object({ controlId: id, type: v3_1.z.enum(['string', 'number', 'boolean', 'date']),
         defaultValue: v3_1.z.union([v3_1.z.string(), v3_1.z.number(), v3_1.z.boolean(), v3_1.z.null()]).optional(),
@@ -21,11 +21,13 @@ exports.dashboardSchema = v3_1.z.object({
         if (new Set(values).size !== values.length)
             ctx.addIssue({ code: 'custom', message: `Duplicate ${name}` });
     };
+    if (!manifest.bindings.length && (manifest.presentation || manifest.controls.length || manifest.charts.length || manifest.tables.length))
+        ctx.addIssue({ code: 'custom', message: 'An unconfigured draft must contain no views or controls' });
     unique(manifest.bindings.map((binding) => binding.id), 'binding');
     unique(manifest.bindings.map((binding) => binding.output.datasetId), 'dataset');
     unique(manifest.controls.map((control) => control.controlId), 'control');
     unique([...manifest.charts, ...manifest.tables].map((view) => view.id), 'view');
-    if (!manifest.presentation && !manifest.charts.length && !manifest.tables.length)
+    if (manifest.bindings.length && !manifest.presentation && !manifest.charts.length && !manifest.tables.length)
         ctx.addIssue({ code: 'custom', message: 'At least one chart or table is required' });
     if (manifest.presentation && (manifest.charts.length || manifest.tables.length))
         ctx.addIssue({ code: 'custom', message: 'HTML presentation owns its charts; use empty charts/tables arrays' });

package/dist/lib/dashboard.service.d.ts

@@ -194,6 +194,11 @@ export declare class DashboardService {
             };
         } | undefined;
         datasets: import("@xpert-ai/contracts").AnalyticalDataset[];
+        failures: {
+            bindingId: string;
+            datasetId: string;
+            reason: "unavailable";
+        }[];
         manifest: {
             schema: "xpert.live-dashboard";
             id: string;
@@ -238,6 +243,9 @@ export declare class DashboardService {
         versionNumber: number | undefined;
     }>;
     queryBinding(context: XpertResolvedViewHostContext, artifactId: string, versionId: string | undefined, bindingId: string, input: Record<string, AnalyticsValue>, draftRevision?: number): Promise<import("@xpert-ai/contracts").AnalyticalDataset>;
+    /** Every operation uses the current human's Project role; data queries still use actor(context). */
+    authorizeProject(context: XpertResolvedViewHostContext, operation?: 'read' | 'write' | 'manage'): Promise<void>;
     private execute;
     private probeControls;
 }
+export declare function projectId(context: XpertResolvedViewHostContext): string | null | undefined;