@xpert-ai/plugin-live-dashboard 0.2.0 → 0.3.1

package/.xpertai-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "@xpert-ai/plugin-live-dashboard",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "level": "system",
   "artifactNamespace": "live_dashboard",
   "sandboxActions": "./dist/sandbox-actions/action.json",

package/README.md

@@ -35,6 +35,17 @@ Tools are `dashboard_list_sources`, `dashboard_discover`, `dashboard_preview`, `
 
 Specialized Assistants may configure `allowedFinalProviders` on the middleware, for example `["workspace_script.query"]`. Upstream discovery and preview still work with other providers, but Agent save rejects final bindings outside this list. Omit it for the existing unrestricted provider workflow. This is an Agent workflow policy, not a substitute for the server's source/Artifact authorization.
 
+The settings form now selects each entry from a dropdown. Options come from
+`GET /api/live-dashboard/provider-options`, using the host Analytics capability
+with the authenticated tenant, organization and user. It lists distinct Provider
+types of **currently accessible data sources**, not every installed adapter or
+individual database connection. The list refreshes on loading the selector;
+unavailable saved IDs remain visible and are not silently removed. A configured
+policy still requires 1–20 values; the saved `string[]` contract is unchanged.
+An empty catalog means no accessible sources; authorization/catalog errors remain
+errors. This uses the existing platform `remoteSelect` control and requires no
+platform changes.
+
 For a dedicated Dashboard Assistant, mark its connected `LiveDashboard` middleware node `required: true` (see the [graph fragment](examples/assistant-middleware.yaml)). ChatKit sends an explicit capability allowlist; an optional middleware is unavailable until the user selects it. Enabling the Workbench view alone does not enable Agent tools. Preserve that platform selection behavior for general-purpose Assistants.
 
 Only the LLM boundary uses `requestJson` / `payloadJson` strings, because recursive JSON unions are unreliable in model function schemas. The plugin parses these into the unchanged canonical JSON protocol before calling the platform. Protocol version and operation come from the discovered provider contract; parameter name also supplies the Agent-created control ID. Saved manifests retain the full generic Binding protocol. Preview uses Binding parameter defaults, avoiding a second control mapping for the model to repeat. Provider syntax is learned from discovery, not embedded in platform prompts.
@@ -57,12 +68,130 @@ Preview/save also probe a declared non-default filter value and, when applicable
 
 Artifacts are owner-only within their agent/project host for this MVP. MIME: `application/json`; resource type: `live-dashboard`; namespace: `live_dashboard`. The Workbench supports selection, JSON import/edit, typed filters, refresh, version/freshness and partial-result notices.
 
+## Built-in prompt workflows / 内置提示词模板
+
+### Chat shortcut buttons / 聊天快捷按钮
+
+Like Presentation Studio, this plugin contributes an Assistant template with
+12 workspace prompt workflows. In the plugin's contents, choose **实时看板助手 /
+Live Dashboard Assistant**, install it into the target workspace, and select the
+model and sandbox in the existing setup wizard. Its required LiveDashboard,
+Skills and SandboxFile middleware nodes are already connected. Workspace prompts
+use `insert_text`: clicking a shortcut opens editable text before sending.
+
+Shortcut resources use names beginning with `live-dashboard-`. The legacy
+middleware commands below keep their `/dashboard-` names: the host gives middleware
+commands precedence, so reusing those names would hide the workspace shortcuts.
+Both paths share the same prompt content. The workspace prompt library remains
+the place to edit labels, content and Assistant associations.
+
+**Existing Assistants:** a plugin update alone does not seed workspace resources.
+Import the prompts once, or associate already imported prompts with the Assistant
+in the workspace prompt library. The following shipped helper supports a one-time
+import without changing the Assistant graph, model, publication or existing prompts:
+
+1. Configure and publish the Assistant with LiveDashboard connected to its main
+   Agent and **System middleware** enabled. Keep its normal Skills, SandboxFile,
+   model and sandbox configuration.
+2. From this plugin package directory (source checkout: build first), use Node 20+
+   and a platform login token with authoring access to the target workspace.
+   Provide `XPERT_TOKEN` through your normal secret environment; do not store it
+   in shell history or commit it. IDs come from the selected organization and
+   published Assistant.
+
+   ```sh
+   node scripts/import-prompts.mjs \
+     --api-url https://your-xpert-host/api \
+     --organization-id YOUR_ORGANIZATION_UUID \
+     --assistant-id YOUR_ASSISTANT_UUID
+   ```
+
+3. Review the read-only preview. Repeat with `--apply` to create only the missing
+   resources, associated with this Assistant. The script then checks the published
+   runtime exposes the new `insert_text` shortcuts. Reopen the chat/new conversation
+   to refresh its command list. No republishing is needed just for prompt import.
+
+The helper never overwrites or archives prompts or changes associations. Matching,
+active and applicable prompts are skipped. Edited/archived prompts, resources
+associated with another Assistant, or disabled/overridden command-profile entries
+stop the import before writes: resolve those deliberately in the prompt library
+or Assistant command settings. For a second Assistant in the same workspace,
+associate the existing resources instead of importing duplicates. Network failures
+can leave some newly created prompts; rerunning safely skips them. Use HTTPS for
+remote hosts and configure trust for private certificates; do not disable TLS
+verification. The helper does not install or update the plugin.
+
+### Middleware slash commands / 中间件斜杠命令
+
+When the Assistant has the `LiveDashboard` middleware, type `/dashboard-` in its
+chat composer and select a workflow. Selection inserts an invocation so the user
+can add requirements before sending; it does not submit or publish automatically.
+Commands are contributed by the installed middleware, so existing Assistants can
+use them after the updated plugin is loaded. No Assistant-template import or
+database seeding is needed. The host must support middleware slash commands.
+
+| Mode / 分类 | Command | 用途 |
+| --- | --- | --- |
+| Standard | `/dashboard-standard-auto` | 根据真实数据质量和业务价值自动选题，新建独立标准看板 |
+| Standard | `/dashboard-standard-new` | 围绕指定主题新建标准看板 |
+| Standard | `/dashboard-standard-improve` | 调整指定看板的图表、指标、筛选，保留 Artifact 身份 |
+| Standard | `/dashboard-standard-recover` | 定位失败步骤，用本轮证据恢复标准草稿保存 |
+| HTML | `/dashboard-html-auto` | 自动选题，新建布局精致、可实际使用的 HTML 看板 |
+| HTML | `/dashboard-html-new` | 围绕指定业务问题、受众和视觉要求新建 HTML 看板 |
+| HTML | `/dashboard-html-style` | 参考图片或风格描述美化已有 HTML 看板，保留查询与交互 |
+| HTML | `/dashboard-html-recover` | 保留页面候选，按真实校验错误修复并恢复保存 |
+| Inspect | `/dashboard-explore` | 只读探索数据源、字段、日期覆盖和候选业务主题 |
+| Inspect | `/dashboard-test-source` | 最小真实查询、字段映射和筛选验证 |
+| Inspect | `/dashboard-audit-metrics` | 只读核对计算、单位、期间和关联粒度 |
+| Inspect | `/dashboard-verify` | 核对保存版本、筛选、刷新，并标明未执行的页面验收 |
+
+Examples (replace the descriptive inputs with your own requirements):
+
+```text
+/dashboard-standard-auto 使用当前组织的 BI 数据源，为采购主管挑选一个数据完整、能帮助识别交付问题的主题。新建独立看板。
+/dashboard-standard-new 使用库存数据，面向仓库主管创建库存积压看板。核实库龄和库存金额口径，提供仓库与日期筛选。
+/dashboard-html-auto 从已授权数据中选择一个能支持日常运营决策的主题。面向部门负责人，浅色企业风格，摘要指标、主趋势、关注清单和明细。
+/dashboard-html-new 创建供应商交付分析看板。使用已授权采购数据，核实交付及时率口径；参考附图的留白、层次和配色，不复制示例数字。
+/dashboard-html-style 美化当前选中的 HTML 看板，参考附图布局；保留现有指标、绑定、筛选和刷新，只调整视觉。
+/dashboard-html-recover 继续保存刚才失败的 HTML 候选。读取实际文件与错误，重新获取本轮所需预览；如果运行时仍不可用，报告准确阻塞。
+/dashboard-test-source 检查当前采购数据源的一个有实际数据的查询，验证一个供应商筛选及全部供应商。
+/dashboard-verify 检查当前看板的默认日期、一个真实筛选值和全部值；区分查询验证与待人工页面验证。
+```
+
+Provide a source name, business question, audience and date range where relevant;
+HTML requests can include a reference image or style. IDs, provider contracts and
+paths are discovered from tools, never hard-coded into the templates. Automatic
+selection ranks business usefulness and data readiness; specified-topic workflows
+do not silently substitute another topic. New HTML workflows choose an unused
+file path and never overwrite the selected dashboard.
+
+The templates guide real queries, metric checks, run-local previews/filter tests
+and successful draft-save receipts. They do not grant source access or install a
+missing Browser Runtime. HTML saves still require runtime validation. Native
+dashboards keep their own renderer and supported chart/table schema. Formal
+publication remains a human action. Inspection commands do not register
+definitions, edit business data or save dashboards; a tool-level pass is not a
+claim of visual acceptance.
+
+### Manual acceptance after loading the plugin
+
+1. In an Assistant with LiveDashboard, open the `/` picker and search `dashboard`.
+   Verify all twelve localized entries; selecting one should leave an editable
+   invocation in the composer.
+2. Run one standard-new and one HTML-new request against an authorized test source.
+   Verify independent Artifact IDs, fresh previews and successful draft receipts;
+   HTML also requires its normal Browser Runtime check.
+3. Reopen each saved draft, change a real filter and refresh. Confirm real data
+   updates. Run an inspection command and verify it does not save a new revision.
+
 ## HTML mode
 
 See [HTML mode and acceptance](docs/html-mode.md). Agent tools write a complete single-file document to the authorized file workspace, then read and copy its bytes into the immutable dashboard JSON version alongside Bindings and Controls. Before creating an Artifact, a plugin-owned Sandbox Action runs the page with real preview datasets in the platform Browser Runtime, through the sandbox-browser queue. Unavailable runtime or failed initial rendering blocks HTML save and returns diagnostics to the Agent. No live workspace path is dereferenced on reopening. A changed file requires a new saved version. Existing JSON-only dashboards remain compatible.
 
 The platform browser entry `@xpert-ai/plugin-sdk/artifact-document` owns the sandbox, CSP, MessageChannel, request validation and latest-response policy. The plugin owns lifecycle and supplies a narrow callback to `query-binding`. Its server loads the exact saved Artifact version, finds the declared Binding, validates controls and rechecks source access. The endpoint rejects full Binding, Provider, SQL/payload and alternate source fields.
 
+HTML preflight checks each native select's alternative/restored values and each button path in a fresh document mount, with at most two pages active. A button path also clicks controls it inserts, reveals or enables, retaining their prerequisite state and the same query quota; traversal is bounded to the first 12 buttons and 12 clicks per path. Every scenario checks initial bindings and host refresh using the same preview datasets. Successful static resources can be reused within this validation (bounded to 32 MB, up to 8 MB per resource); every replay still passes the resource policy, and failed, redirected or non-cacheable responses are not replayed. A 55-second validation deadline fails closed and cancels remaining pages before the host's 60-second Action limit. This prevents repeated resource downloads and the synthetic interaction sweep from exhausting the Action budget or one document's rate window without raising the SDK's query/concurrency limits. A request storm within a scenario still blocks saving; preflight is not a full combinatorial or sustained-load test.
+
 Pages call `window.xpertLiveArtifact.ready()`, `subscribe(bindingId, render)`, `query(bindingId, controls)` and `refresh(bindingId)`. Register subscriptions before the first query so the toolbar can refresh without resetting the document. Use inline DOM/SVG/Canvas or online scripts/styles/fonts from the HTTPS origins returned by `dashboard_libraries.online`. Tailwind CDN, jsDelivr, cdnjs, unpkg and Google Fonts are supported according to their resource-type allowlist. Preflight and the displayed page use the same policy; failed loads prevent saving. Pin online versions where possible. Unlike packaged libraries, online bytes are not part of the immutable Artifact snapshot. Direct data requests, external images, eval, workers and frames remain unavailable. Script processing remains in the separate Workspace Script provider.
 
 HTML is capped at 300 KB; the whole saved definition remains capped at 600 KB. HTML pages own their chart layout, so their charts/tables arrays are empty. The standard renderer remains an independent option. Sharing, data permissions and source limits are unchanged.
@@ -107,3 +236,11 @@ The Share action publishes a link to an already published dashboard: follow the
 See [team sharing and standalone pages](docs/team-sharing.mdx) and [local acceptance](docs/team-sharing-acceptance.mdx). This feature needs a host exposing the Artifact Presentation registry, API and page; it cannot be installed on an older SDK alone.
 
 Chat messages use the platform resource-card protocol after a successful create, update or open. The card opens the exact dashboard in Workbench; no dashboard renderer or queries are embedded in messages. See [chat resource cards](docs/chat-resource-cards.mdx).
+
+### Delete a saved dashboard
+
+Open the dashboard picker and use the trash icon beside an entry. The confirmation shows its title and Artifact ID, so same-name dashboards can be distinguished. Deletion recycles the whole dashboard (draft and published versions), removes it from the active list and revokes shared links; it does not delete source data or Assistant workspace files. Deleting the selected dashboard clears its preview and Assistant context; deleting another dashboard preserves the current view.
+
+The owner can delete private Assistant dashboards; Project dashboards require the current user's management permission. Read-only shared pages expose no delete control. The platform checks the confirmed draft revision atomically, rejecting concurrent edits. Entries without a saved working draft (legacy version-only or incomplete first saves) have no recycle revision and do not expose this action. No Agent deletion tool is registered.
+
+Manual acceptance after installing the updated plugin: cancel a deletion and confirm the entry remains; delete an unused saved dashboard and confirm it stays absent after reload; delete the selected dashboard and confirm the preview clears and its old shared link is unavailable.

package/dist/index.js

@@ -3,9 +3,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const plugin_1 = require("./lib/plugin");
+const assistant_template_1 = require("./lib/assistant-template");
+const dashboard_icon_1 = require("./lib/dashboard-icon");
 const packageJson = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, '../package.json'), 'utf8'));
 const plugin = {
-    meta: { name: packageJson.name, version: packageJson.version, category: 'middleware', displayName: 'Live dashboards', description: 'Live dashboards', author: 'XpertAI', level: packageJson.xpert.plugin.level, artifactNamespace: packageJson.xpert.plugin.artifactNamespace },
+    meta: {
+        name: packageJson.name, version: packageJson.version, category: 'middleware', displayName: 'Live dashboards', description: 'Live dashboards',
+        author: 'XpertAI', level: packageJson.xpert.plugin.level, artifactNamespace: packageJson.xpert.plugin.artifactNamespace, icon: dashboard_icon_1.dashboardIcon,
+        targetApps: ['xpert'],
+        targetAppMeta: { xpert: { types: ['assistant-template'], marketplace: { contents: [
+                        { type: 'assistant-template', name: assistant_template_1.DASHBOARD_TEMPLATE_KEY, displayName: assistant_template_1.dashboardAssistantTemplate.title, description: assistant_template_1.dashboardAssistantTemplate.description }
+                    ] } } }
+    },
+    templates: [assistant_template_1.dashboardAssistantTemplate],
     register: () => ({ module: plugin_1.LiveDashboardPlugin })
 };
 exports.default = plugin;

package/dist/lib/assistant-template.d.ts

@@ -0,0 +1,3 @@
+import type { XpertTemplateContribution } from '@xpert-ai/plugin-sdk';
+export declare const DASHBOARD_TEMPLATE_KEY = "live-dashboard-assistant";
+export declare const dashboardAssistantTemplate: XpertTemplateContribution;

package/dist/lib/assistant-template.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dashboardAssistantTemplate = exports.DASHBOARD_TEMPLATE_KEY = void 0;
+const contracts_1 = require("@xpert-ai/contracts");
+const dashboard_icon_1 = require("./dashboard-icon");
+const prompt_workflows_1 = require("./prompt-workflows");
+exports.DASHBOARD_TEMPLATE_KEY = 'live-dashboard-assistant';
+const agentKey = 'Agent_LiveDashboard';
+const middlewares = [
+    { key: 'Middleware_LiveDashboard', provider: 'LiveDashboard', title: '实时看板' },
+    { key: 'Middleware_Skills', provider: 'skillsMiddleware', title: 'Skills' },
+    { key: 'Middleware_SandboxFile', provider: 'SandboxFile', title: 'Sandbox files' }
+];
+// The installation wizard resolves the model and sandbox provider for the target workspace.
+exports.dashboardAssistantTemplate = {
+    key: exports.DASHBOARD_TEMPLATE_KEY,
+    name: 'Live Dashboard Assistant',
+    title: { en_US: 'Live Dashboard Assistant', zh_Hans: '实时看板助手' },
+    description: {
+        en_US: 'Create and improve standard or HTML dashboards from authorized data, with twelve editable prompt shortcuts.',
+        zh_Hans: '基于授权数据创建和优化标准或 HTML 看板，附带 12 个可编辑快捷提示词。'
+    },
+    icon: dashboard_icon_1.dashboardIcon,
+    type: contracts_1.XpertTypeEnum.Agent,
+    category: 'Analytics',
+    targetApps: ['xpert'],
+    dependencies: { plugins: ['@xpert-ai/plugin-live-dashboard'] },
+    promptWorkflows: prompt_workflows_1.dashboardWorkspacePrompts,
+    dslContent: JSON.stringify({
+        team: {
+            name: 'live-dashboard-assistant', type: 'agent', title: '实时看板助手',
+            description: 'Create verified live dashboards from authorized business data.',
+            agent: { key: agentKey },
+            features: { sandbox: { enabled: true } },
+            version: '1'
+        },
+        nodes: [
+            {
+                type: 'agent', key: agentKey, position: { x: 480, y: 40 },
+                entity: {
+                    key: agentKey, name: 'live-dashboard-assistant', title: '实时看板助手',
+                    prompt: 'Use the LiveDashboard tools and installed live-dashboard skill. Discover authorized data, verify business metrics and previews, then save a draft. Report success only after a successful save receipt. Match the user language.',
+                    options: { middlewares: { order: middlewares.map(({ key }) => key) } },
+                    collaboratorNames: [], toolsetIds: [], knowledgebaseIds: []
+                }
+            },
+            ...middlewares.map(({ key, provider, title }, index) => ({
+                type: 'workflow', key, position: { x: index * 320, y: 320 },
+                entity: { type: 'middleware', key, provider, title, required: true, options: {} }
+            }))
+        ],
+        connections: middlewares.map(({ key }) => ({ type: 'workflow', key: `${agentKey}/${key}`, from: agentKey, to: key }))
+    }),
+    default: false,
+    order: 75
+};

package/dist/lib/dashboard-view.schema.d.ts

@@ -6,6 +6,7 @@ export declare const dashboardSummarySchema: z.ZodObject<{
     title: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     updatedAt: z.ZodOptional<z.ZodString>;
     draftRevision: z.ZodOptional<z.ZodNumber>;
+    canDelete: z.ZodOptional<z.ZodBoolean>;
     isDraft: z.ZodOptional<z.ZodBoolean>;
     baseVersionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, "strip", z.ZodTypeAny, {
@@ -17,6 +18,7 @@ export declare const dashboardSummarySchema: z.ZodObject<{
     baseVersionId?: string | null | undefined;
     isDraft?: boolean | undefined;
     updatedAt?: string | undefined;
+    canDelete?: boolean | undefined;
 }, {
     artifactId: string;
     title?: string | null | undefined;
@@ -26,6 +28,7 @@ export declare const dashboardSummarySchema: z.ZodObject<{
     baseVersionId?: string | null | undefined;
     isDraft?: boolean | undefined;
     updatedAt?: string | undefined;
+    canDelete?: boolean | undefined;
 }>;
 export declare const dashboardSavedSchema: z.ZodObject<{
     artifactId: z.ZodString;
@@ -34,6 +37,7 @@ export declare const dashboardSavedSchema: z.ZodObject<{
     title: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     updatedAt: z.ZodOptional<z.ZodString>;
     draftRevision: z.ZodOptional<z.ZodNumber>;
+    canDelete: z.ZodOptional<z.ZodBoolean>;
     isDraft: z.ZodOptional<z.ZodBoolean>;
     baseVersionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 } & {
@@ -365,6 +369,7 @@ export declare const dashboardSavedSchema: z.ZodObject<{
     baseVersionId?: string | null | undefined;
     isDraft?: boolean | undefined;
     updatedAt?: string | undefined;
+    canDelete?: boolean | undefined;
 }, {
     manifest: {
         schema: "xpert.live-dashboard";
@@ -421,6 +426,7 @@ export declare const dashboardSavedSchema: z.ZodObject<{
     baseVersionId?: string | null | undefined;
     isDraft?: boolean | undefined;
     updatedAt?: string | undefined;
+    canDelete?: boolean | undefined;
 }>;
 export declare const dashboardViewDataSchema: z.ZodObject<{
     meta: z.ZodObject<{
@@ -453,6 +459,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             title: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             updatedAt: z.ZodOptional<z.ZodString>;
             draftRevision: z.ZodOptional<z.ZodNumber>;
+            canDelete: z.ZodOptional<z.ZodBoolean>;
             isDraft: z.ZodOptional<z.ZodBoolean>;
             baseVersionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         }, "strip", z.ZodTypeAny, {
@@ -464,6 +471,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         }, {
             artifactId: string;
             title?: string | null | undefined;
@@ -473,6 +481,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         }>, "many">;
         sources: z.ZodArray<z.ZodObject<{
             source: z.ZodType<import("@xpert-ai/contracts").AnalyticsSourceRef, z.ZodTypeDef, import("@xpert-ai/contracts").AnalyticsSourceRef>;
@@ -491,6 +500,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             title: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             updatedAt: z.ZodOptional<z.ZodString>;
             draftRevision: z.ZodOptional<z.ZodNumber>;
+            canDelete: z.ZodOptional<z.ZodBoolean>;
             isDraft: z.ZodOptional<z.ZodBoolean>;
             baseVersionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         } & {
@@ -822,6 +832,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         }, {
             manifest: {
                 schema: "xpert.live-dashboard";
@@ -878,6 +889,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         }>>;
         versions: z.ZodOptional<z.ZodArray<z.ZodObject<{
             artifactId: z.ZodString;
@@ -886,6 +898,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             title: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             updatedAt: z.ZodOptional<z.ZodString>;
             draftRevision: z.ZodOptional<z.ZodNumber>;
+            canDelete: z.ZodOptional<z.ZodBoolean>;
             isDraft: z.ZodOptional<z.ZodBoolean>;
             baseVersionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         }, "strip", z.ZodTypeAny, {
@@ -897,6 +910,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         }, {
             artifactId: string;
             title?: string | null | undefined;
@@ -906,6 +920,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         }>, "many">>;
     }, "strip", z.ZodTypeAny, {
         sources: {
@@ -921,6 +936,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         }[];
         saved?: {
             manifest: {
@@ -965,6 +981,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         } | undefined;
         navigationTarget?: {
             target: "workbench.view";
@@ -983,6 +1000,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         }[] | undefined;
     }, {
         sources: {
@@ -998,6 +1016,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         }[];
         saved?: {
             manifest: {
@@ -1055,6 +1074,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         } | undefined;
         navigationTarget?: {
             target: "workbench.view";
@@ -1073,6 +1093,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         }[] | undefined;
     }>;
 }, "strip", z.ZodTypeAny, {
@@ -1090,6 +1111,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         }[];
         saved?: {
             manifest: {
@@ -1134,6 +1156,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         } | undefined;
         navigationTarget?: {
             target: "workbench.view";
@@ -1152,6 +1175,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         }[] | undefined;
     };
 }, {
@@ -1169,6 +1193,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         }[];
         saved?: {
             manifest: {
@@ -1226,6 +1251,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         } | undefined;
         navigationTarget?: {
             target: "workbench.view";
@@ -1244,6 +1270,7 @@ export declare const dashboardViewDataSchema: z.ZodObject<{
             baseVersionId?: string | null | undefined;
             isDraft?: boolean | undefined;
             updatedAt?: string | undefined;
+            canDelete?: boolean | undefined;
         }[] | undefined;
     };
 }>;

package/dist/lib/dashboard-view.schema.js

@@ -6,7 +6,7 @@ const analytics_1 = require("@xpert-ai/plugin-sdk/analytics");
 const artifact_document_1 = require("@xpert-ai/plugin-sdk/artifact-document");
 const dashboard_schema_1 = require("./dashboard.schema");
 const dashboard_navigation_1 = require("./dashboard-navigation");
-exports.dashboardSummarySchema = v3_1.z.object({ artifactId: v3_1.z.string(), versionId: v3_1.z.string().nullish(), versionNumber: v3_1.z.number().optional(), title: v3_1.z.string().nullish(), updatedAt: v3_1.z.string().optional(), draftRevision: v3_1.z.number().optional(), isDraft: v3_1.z.boolean().optional(), baseVersionId: v3_1.z.string().nullish() });
+exports.dashboardSummarySchema = v3_1.z.object({ artifactId: v3_1.z.string(), versionId: v3_1.z.string().nullish(), versionNumber: v3_1.z.number().optional(), title: v3_1.z.string().nullish(), updatedAt: v3_1.z.string().optional(), draftRevision: v3_1.z.number().optional(), canDelete: v3_1.z.boolean().optional(), isDraft: v3_1.z.boolean().optional(), baseVersionId: v3_1.z.string().nullish() });
 exports.dashboardSavedSchema = exports.dashboardSummarySchema.extend({ manifest: dashboard_schema_1.dashboardSchema, dependencies: artifact_document_1.artifactDocumentDependencyAssets.optional() });
 // Source identities belong to Analytics, including immutable Definitions and Artifacts.
 // The viewer consumes only the reference and label; DataSource fields are not universal.

package/dist/lib/dashboard.service.d.ts

@@ -12,11 +12,16 @@ export declare class DashboardService {
     preview(context: XpertResolvedViewHostContext, input: AnalyticsQueryRequest): Promise<import("@xpert-ai/contracts").AnalyticalDataset>;
     list(context: XpertResolvedViewHostContext): Promise<{
         title: string | null | undefined;
+        draftRevision?: number | undefined;
+        canDelete: boolean;
         artifactId: string;
         versionId: string | null | undefined;
         versionNumber: number | undefined;
         updatedAt: string | Date | undefined;
     }[]>;
+    trash(context: XpertResolvedViewHostContext, artifactId: string, expectedRevision: number): Promise<{
+        artifactId: string;
+    }>;
     save(context: XpertResolvedViewHostContext, manifest: DashboardManifest, expectedVersionId: string | null, expectedRevision?: number): Promise<{
         artifactId: string;
         draftId: string;
@@ -244,7 +249,7 @@ export declare class DashboardService {
     }>;
     queryBinding(context: XpertResolvedViewHostContext, artifactId: string, versionId: string | undefined, bindingId: string, input: Record<string, AnalyticsValue>, draftRevision?: number): Promise<import("@xpert-ai/contracts").AnalyticalDataset>;
     /** Every operation uses the current human's Project role; data queries still use actor(context). */
-    authorizeProject(context: XpertResolvedViewHostContext, operation?: 'read' | 'write' | 'manage'): Promise<void>;
+    authorizeProject(context: XpertResolvedViewHostContext, operation?: 'read' | 'write' | 'manage'): Promise<import("@xpert-ai/plugin-sdk").ProjectHumanAccess | undefined>;
     private execute;
     private probeControls;
 }

package/dist/lib/dashboard.service.js

@@ -40,11 +40,25 @@ let DashboardService = class DashboardService {
         return dataset;
     }
     async list(context) {
-        await this.authorizeProject(context);
+        const access = await this.authorizeProject(context);
         const result = await this.runtime.require(plugin_sdk_1.ArtifactsRuntimeCapability).listArtifacts({ pluginName: exports.PLUGIN_NAME, resourceType: RESOURCE_TYPE, resourceIdPrefix: hostPrefix(context), status: 'active', pageSize: 100, includeCurrentVersion: true });
         const items = result.items.filter((item) => item.resourceId.startsWith(hostPrefix(context)) && (item.userId === context.userId || !item.userId && item.projectId === projectId(context)));
         const drafts = new Map((await this.runtime.require(plugin_sdk_1.ArtifactDraftsRuntimeCapability).list(items.map(item => item.id))).map(draft => [draft.artifactId, draft]));
-        return items.map(item => ({ ...summary(item), ...(drafts.has(item.id) ? { title: drafts.get(item.id).title ?? item.title } : {}) }));
+        return items.map(item => {
+            const draft = drafts.get(item.id);
+            return { ...summary(item), canDelete: !!draft && (!projectId(context) || access?.canManage === true),
+                ...(draft ? { title: draft.title ?? item.title, draftRevision: draft.revision } : {}) };
+        });
+    }
+    async trash(context, artifactId, expectedRevision) {
+        await this.authorizeProject(context, 'manage');
+        const artifact = await this.runtime.require(plugin_sdk_1.ArtifactsRuntimeCapability).getArtifact(artifactId);
+        assertOwned(context, artifact);
+        if (artifact.status !== 'active')
+            throw new common_1.ForbiddenException('DASHBOARD_ARCHIVED');
+        // Reuse the platform's atomic revision check, recycle state and share revocation.
+        await this.runtime.require(plugin_sdk_1.ArtifactDraftsRuntimeCapability).setRecycled({ artifactId, expectedRevision, recycled: true });
+        return { artifactId };
     }
     async save(context, manifest, expectedVersionId, expectedRevision = 0) {
         await this.authorizeProject(context, 'write');
@@ -175,11 +189,13 @@ let DashboardService = class DashboardService {
         if (context.hostType === 'agent')
             await access.assertAssistant({ ...input, assistantId: context.hostId });
         if (operation === 'write')
-            await access.assertEdit(input);
-        else if (operation === 'manage')
-            await access.assertManage(input);
-        else if (!(await access.listReadable({ actor: scopedActor, projectIds: [project] })).length)
+            return access.assertEdit(input);
+        if (operation === 'manage')
+            return access.assertManage(input);
+        const readable = (await access.listReadable({ actor: scopedActor, projectIds: [project] })).find(item => item.projectId === project);
+        if (!readable)
             throw new common_1.ForbiddenException('DASHBOARD_ACCESS_DENIED');
+        return readable;
     }
     execute(context, manifest, input) {
         return (0, dashboard_queries_1.queryDashboard)(this.runtime, actor(context), manifest, input);

package/dist/lib/middleware.js

@@ -33,7 +33,12 @@ const save_evidence_1 = require("./save-evidence");
 const resource_card_1 = require("./resource-card");
 const dashboard_icon_1 = require("./dashboard-icon");
 const preview_retry_1 = require("./preview-retry");
+const prompt_workflows_1 = require("./prompt-workflows");
 const middlewareOptionsSchema = v3_1.z.object({ allowedFinalProviders: v3_1.z.array(v3_1.z.string().min(1)).min(1).max(20).optional() }).strict().default({});
+const providerOptionSchema = {
+    type: 'string',
+    'x-ui': { component: 'remoteSelect', selectUrl: '/api/live-dashboard/provider-options' }
+};
 exports.DASHBOARD_GUIDANCE = `For a new independent dashboard, use a new unused HTML file path. An existing filename or matching title is not authorization to edit another Artifact; do not switch from creation to dashboard_open/update because a file already exists. For a new dashboard, call dashboard_list_sources before searching raw files, reading old scripts or creating transformations. Named governed sources may already provide the required query; inspect their provider contracts first. File-backed sources do not imply that a script must be written. For creating or editing live dashboards, first read the installed live-dashboard skill using read_skill_file and follow only the references relevant to the task. Use SandboxFile tools for all source-file authoring; HTML alone is not a saved dashboard. Follow preview.validation.checks immediately before authoring HTML; each suggestedCall must actually succeed. Business definitions, real data previews and nullable-filter tests are required before saving new or changed Bindings. Do not invent business data or substitute a different metric without agreement. Report completion only from a successful dashboard_create/dashboard_create_html/dashboard_update draft receipt. Human publication is separate. Successful create, update and open tools emit a chat resource card automatically; resourceCard.status reports emission. Its Open button selects the exact dashboard in Workbench. Never fabricate a link, call present_files for dashboard HTML, or output card JSON as text. If card delivery is unavailable, report the saved receipt and use the Workbench picker.`;
 let DashboardMiddleware = class DashboardMiddleware {
     constructor(service) {
@@ -41,10 +46,11 @@ let DashboardMiddleware = class DashboardMiddleware {
         this.meta = {
             name: 'LiveDashboard', label: { en_US: 'Live dashboards', zh_Hans: '实时看板' },
             description: { en_US: 'Discover, preview, create and update governed live dashboards.', zh_Hans: '发现业务数据、验证查询并持续修改实时看板。' },
+            slashCommands: prompt_workflows_1.dashboardPromptWorkflows,
             // Tools inherit this self-contained icon through the platform middleware metadata.
             icon: dashboard_icon_1.dashboardIcon, features: [view_provider_1.FEATURE], configSchema: { type: 'object', properties: {
-                    allowedFinalProviders: { type: 'array', items: { type: 'string' }, title: { en_US: 'Allowed final dashboard providers', zh_Hans: '最终看板允许的 Provider' },
-                        description: { en_US: 'Optional provider IDs required for saved Agent dashboards. Upstream previews remain available.', zh_Hans: '可选的最终看板 Provider ID 列表，不限制上游来源预览。' } }
+                    allowedFinalProviders: { type: 'array', minItems: 1, maxItems: 20, items: providerOptionSchema, title: { en_US: 'Allowed final dashboard providers', zh_Hans: '最终看板允许的数据源类型' },
+                        description: { en_US: 'Choose at least one provider from sources you can access when setting this policy. Existing unavailable IDs are retained. Upstream previews remain available.', zh_Hans: '配置此限制时至少选择一种当前可访问数据源的 Provider；暂不可用的已有值会保留，不影响上游来源预览。' } }
                 }, additionalProperties: false }
         };
     }

package/dist/lib/plugin.js

@@ -16,9 +16,10 @@ const middleware_1 = require("./middleware");
 const html_validation_1 = require("./html-validation");
 const presentation_provider_1 = require("./presentation.provider");
 const sharing_service_1 = require("./sharing.service");
+const provider_options_controller_1 = require("./provider-options.controller");
 let LiveDashboardPlugin = class LiveDashboardPlugin {
 };
 exports.LiveDashboardPlugin = LiveDashboardPlugin;
 exports.LiveDashboardPlugin = LiveDashboardPlugin = __decorate([
-    (0, plugin_sdk_1.XpertServerPlugin)({ providers: [content_capability_1.DashboardCapability, content_provider_1.DashboardContentProvider, content_provider_1.DashboardContentEditor, dashboard_service_1.DashboardService, view_provider_1.DashboardViewProvider, middleware_1.DashboardMiddleware, html_validation_1.HtmlDashboardValidation, presentation_provider_1.DashboardPresentationProvider, sharing_service_1.DashboardSharingService] })
+    (0, plugin_sdk_1.XpertServerPlugin)({ controllers: [provider_options_controller_1.DashboardProviderOptionsController], providers: [content_capability_1.DashboardCapability, content_provider_1.DashboardContentProvider, content_provider_1.DashboardContentEditor, dashboard_service_1.DashboardService, view_provider_1.DashboardViewProvider, middleware_1.DashboardMiddleware, html_validation_1.HtmlDashboardValidation, presentation_provider_1.DashboardPresentationProvider, sharing_service_1.DashboardSharingService] })
 ], LiveDashboardPlugin);

package/dist/lib/prompt-workflows.d.ts

@@ -0,0 +1,4 @@
+import type { SkillSlashCommand, TPromptWorkflow } from '@xpert-ai/contracts';
+export declare const dashboardPromptWorkflows: SkillSlashCommand[];
+/** Separate names keep the host's middleware-first merge from hiding these editable shortcuts. */
+export declare const dashboardWorkspacePrompts: TPromptWorkflow[];